Privacy Policy

This privacy notice explains what information uMake collects when you use our app, our websites and our other services, why we collect it, who we share it with, how long we keep it, and the rights and choices you have.

Interpretation and Definitions

This privacy notice for uMake, Inc. ("uMake," "we," "us," or "our") describes how and why we collect, store, use, and/or share ("process") your information when you use our services ("Services"), such as when you:

• Download and use the uMake app for iPad and iPhone (the "App")
• Visit our websites, including www.umake.com and try.umake.com, or account.umake.com, where you buy and manage plans, Teams and school licenses, or any other website of ours that links to this privacy notice
• Use uMake through a school, college or university, or through an organization, that has a uMake license or Team
• Contact us, or engage with us in other related ways, including any sales, marketing, or events

Questions or concerns? Reading this privacy notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at hello@umake.com.

SUMMARY OF KEY POINTS

This summary provides key points from our privacy notice, but you can find out more details about any of these topics by using our table of contents below to find the section you are looking for.

What personal information do we process? Your account details, such as your name and email address; what you create and add in uMake, such as designs, photos, videos, 3D models and prompts; your purchases; and information about your device and how you use the Services. See "WHAT INFORMATION DO WE COLLECT?"

Do we use third-party AI? Yes. uMake's AI features, such as Design Partner, Live AI Preview, the image and video tools, Scene Studio and image to 3D, send what you give them (your words, photos, sketches and pictures of your canvas) to AI providers, including OpenAI, Google, Anthropic and fal, which create the result you asked for. This happens only when you use an AI feature. See "HOW DO OUR AI FEATURES USE YOUR INFORMATION?"

Do we process any sensitive personal information? We do not collect information about your health, biometrics, racial or ethnic origin, religion or precise location. Some laws treat your account login and information about your school as sensitive; we use them only to provide the Services.

Do we receive any information from third parties? Yes. When you sign in with Apple, Google or Microsoft, they tell us your name and email address. Apple and Stripe tell us about your purchases. Your school or organization may give you access to uMake through its license or Team.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so.

In what situations and with which types of parties do we share personal information? With the service providers who help us run uMake, whom we name in "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?"; with Meta, which we tell about your use of the App and your purchases to measure our advertising; and with your school or organization if you use uMake through one.

Do schools and students use uMake? Yes. Schools, colleges and universities can buy licenses for their students and staff, and students can get a free Education plan. See "SCHOOLS, STUDENTS AND CHILDREN"

How do we keep your information safe? We have organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information.

What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information.

How do I exercise my rights? You can delete your account and its data at any time in the App (Settings > Delete Account). For anything else, email us at hello@umake.com. We will consider and act upon any request in accordance with applicable data protection laws.

Table of Contents

1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?
4. HOW DO OUR AI FEATURES USE YOUR INFORMATION?
5. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
6. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
7. HOW DO WE HANDLE SIGN-IN WITH APPLE, GOOGLE AND MICROSOFT?
8. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?
9. HOW LONG DO WE KEEP YOUR INFORMATION, AND WHAT HAPPENS WHEN YOU DELETE YOUR ACCOUNT?
10. HOW DO WE KEEP YOUR INFORMATION SAFE?
11. SCHOOLS, STUDENTS AND CHILDREN
12. WHAT ARE YOUR PRIVACY RIGHTS?
13. CONTROLS FOR DO-NOT-TRACK FEATURES
14. DO RESIDENTS OF CALIFORNIA AND OTHER US STATES HAVE SPECIFIC PRIVACY RIGHTS?
15. DO WE MAKE UPDATES TO THIS NOTICE?
16. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
17. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you provide to us when you create an account or sign in, when you use the Services, when you buy a plan, credit pack, Team or license, when you apply for the Education plan, or when you contact us. What we collect depends on how you use the Services, and may include:

• Account information. Your name, your email address, your password if you sign up with an email address, the service you sign in with (see "HOW DO WE HANDLE SIGN-IN WITH APPLE, GOOGLE AND MICROSOFT?"), your profile picture if you add one, your language, and whether you allow notifications. If you use the App without signing in, we create a guest account for your device.
• What you create and add. Your designs and their files, drawings and thumbnails; the photos, videos and 3D models you add to Spaces; the images, videos and 3D models our AI features make for you; the shapes, styles, textures and parts you save; and the prompts behind your AI results. See "Spaces, My Media and your designs" below.
• What you give our AI features. The words you type or say, the pictures and videos you attach, and pictures of your canvas that the App sends with them. See "HOW DO OUR AI FEATURES USE YOUR INFORMATION?"
• Purchase information. The plan, credit pack, Team or license you bought, its price, dates and status, the AI credits you have and use, and the transaction numbers Apple or Stripe give us. We do not receive or store your card number (see "Payment Data" below).
• School, Team and organization information. If you buy or manage a school license or a Team: the name of your school or organization, the school email address you confirm with a code, your statement that you are buying for a school, college or university, the number of seats, and, if you pay by invoice, a purchase order number and billing address. If you ask us to add your school, its name and website. If you join a license or a Team: that you are a member and, if your seat includes AI credits, how many of them you have used this month and when you last used them. If you invite someone to a Team: their email address.
• Education plan applications. If you apply on our website: your name, school email address, school, country and level of study, and anything else you choose to add (your course, graduation year, a teacher's email address, a message).
• What you tell us. The emails you send us and what you send through our websites' forms, with anything you attach. When you write to us from the App, the email starts with your user ID and device ID, and some messages attach the App's log files or the design you are asking about.
• Survey answers. Your answers to optional questions in the App, such as what brings you to uMake and where you heard about us.

Sensitive Information. We do not ask for information about your health, biometrics, racial or ethnic origin, religion, sexual orientation or precise location. Your account login, and information about your school if you are a student, are considered sensitive by some laws; we use them only to provide the Services.

Payment Data. When you buy in the App, Apple takes the payment and we receive the transaction from Apple. When you buy on account.umake.com, Stripe collects your payment details on its own checkout pages and sends us the result; for some web plans and Teams, Link, Stripe's checkout, sells and bills them to you. We also use Chargebee, a subscription billing service, which receives the name and email address of signed-in accounts and manages some older subscriptions. We never see your full card number. You may find their privacy notices here: https://www.apple.com/legal/privacy/, https://stripe.com/privacy, https://link.com/privacy and https://www.chargebee.com/privacy/.

Sign-in Data. If you sign in with Apple, Google or Microsoft, we receive the information described in "HOW DO WE HANDLE SIGN-IN WITH APPLE, GOOGLE AND MICROSOFT?"

Spaces, My Media and your designs. When you are signed in, your designs and their thumbnails, the photos, videos and 3D models in your Spaces, your My Media and My Textures (each with the prompt that made it), your Scene Studio images and clips, and your saved library are stored in your uMake account, so you can open them on your other devices and after reinstalling the App. They are linked to your account and kept until you delete them or your account. A guest's photos, videos and models stay on the device. Design Partner conversations are kept on your device only; each message you send goes to our AI service with the latest messages of the conversation to get a reply (see section 4).

Application Data. If you use our App, we also may collect the following information if you choose to provide us with access or permission:

• Device Access. The App asks before it uses your camera (to take reference photos), your photo library (to add photos and to save images), your microphone and Apple's speech recognition (to turn what you say into a prompt), and Bluetooth (for Apple Pencil). Speech recognition is done by Apple, on your device where your language allows it; we receive only the words, never the recording. If you wish to change our access or permissions, you may do so in your device's settings.
• Push Notifications. We may ask to send you notifications about your account and about new tools and ideas in uMake. If you wish to opt out from receiving these types of communications, you may turn them off in your device's settings.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In Short: Some information — such as your Internet Protocol (IP) address, your device and how you use the Services — is collected automatically when you use our Services.

We automatically collect certain information when you visit, use, or navigate the Services. The information we collect includes:

• Usage Data. Which features you use and when, the names of your designs and files, the purchases you make and your subscription status, searches in the App's help that find nothing, and similar events. In the App, this information is linked to your account (see "Analytics and measurement" in section 5).
• Device Data. Your device model, operating system and version, the App's version, your language, the identifier Apple gives the App for your device, and your IP address.
• Advertising and Attribution Data. If you allow tracking when the App asks (Apple's App Tracking Transparency), your device's advertising identifier. Information about the ad or campaign that led you to the App, from Apple Search Ads and Apple's SKAdNetwork. See "DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?"
• Crash and Diagnostic Data. Apple shares crash reports and diagnostics with us from people who choose to share them with app developers in their device's settings; these do not tell us who you are.
• Log Data. Our servers record each request with its date and time, your IP address, your user ID and your account's email address, and what was asked for.
• Website Data. On our websites, cookies and similar technologies record the pages you visit, how you got there and what you click. You can find out more in "DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?" and in our Cookies Policy: https://www.umake.com/legal/cookie.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To create and manage your account and sign you in. We may process your information so you can create and log in to your account, link your sign-in methods, and keep your account in working order.
• To deliver the Services you ask for. We may process your information to provide you with the requested service, including storing your designs and Spaces media in your account, and running the AI features you use.
• To provide school licenses, Teams and the Education plan. We may process your information to check that a school license is bought for a school (with the school email address you confirm), to check Education plan applications, to add members to a license or Team and show its managers who has joined and how many of their seat's AI credits each member has used, and to recognize when your sign-in belongs to an organization whose Team you may join.
• To fulfill and manage your purchases. We may process your information to fulfill and manage your orders, subscriptions, credit packs, payments, renewals and refunds.
• To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service. An AI assistant helps us read and answer the messages sent to us (see section 5).
• To send administrative information to you. We may process your information to send you emails such as email confirmations, password resets, school email codes, license and Team notices, invitations and receipts, and changes to our terms and policies.
• To send you marketing and promotional communications. We may process your information to tell you about new tools and ideas in uMake, if this is in accordance with your marketing preferences. You can turn this off at any time (see "WHAT ARE YOUR PRIVACY RIGHTS?").
• To identify usage trends and improve our Services. We may process information about how you use our Services to better understand how they are being used so we can improve them.
• To measure our advertising. We may process information about how you came to the App, how you use it and whether you subscribed, to learn which of our campaigns work.
• To fix problems. We may process crash reports, diagnostics and logs to find and fix problems.
• To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention, limits on how often a service can be used, and the AI credits that come with your plan.
• To comply with the law. We may process your information to comply with our legal obligations, such as tax and accounting rules.
• To save or protect an individual's vital interest. We may process your information when necessary to save or protect an individual’s vital interest, such as to prevent harm.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfill our contractual obligations, to protect your rights, or to fulfill our legitimate business interests.

If you are located in the EU or UK, this section applies to you.

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases to process your personal information:

• Consent. We may process your information if you have given us permission (i.e., consent) to use your personal information for a specific purpose: for example, when you allow tracking in the App, and when you allow notifications. You can withdraw your consent at any time (see "WHAT ARE YOUR PRIVACY RIGHTS?").
• Performance of a Contract. We may process your personal information when we believe it is necessary to fulfill our contractual obligations to you, including providing our Services (such as your account, the storage of your designs and media, and the AI features you use) or at your request prior to entering into a contract with you.
• Legitimate Interests. We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests and those interests do not outweigh your interests and fundamental rights and freedoms.

  For example, we may process your personal information for some of the purposes described in order to:

  • Analyze how our services are used so we can improve them to engage and retain users
  • Diagnose problems and/or prevent fraudulent activities
  • Understand how our users use our products and services so we can improve user experience
  • Answer your questions and support requests
  • Measure how well our advertising works
• Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations, such as to keep tax and accounting records, cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.
• Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.

If you are located in Canada, this section applies to you.

We may process your information if you have given us specific permission (i.e., express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e., implied consent). You can withdraw your consent at any time.

In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:

• If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
• For investigations and fraud detection and prevention
• For business transactions provided certain conditions are met
• If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
• For identifying injured, ill, or deceased persons and communicating with next of kin
• If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse
• If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province
• If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
• If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced
• If the collection is solely for journalistic, artistic, or literary purposes
• If the information is publicly available and is specified by the regulations

4. HOW DO OUR AI FEATURES USE YOUR INFORMATION?

In Short: When you use an AI feature, what you give it (your words, your photos and sketches, and pictures of your canvas) goes from our AI service to an AI provider, which creates the result. This happens only when you use an AI feature. We do not send these providers your name or email address.

Which features use AI. Design Partner (the chat in the editor and in Spaces), Live AI Preview, the image tools (create, edit, sketch, variations, cutout, presentation and styles), video and Flows, Scene Studio, image to 3D and text to 3D, picture captions, and "Start from an idea." You don't have to use them to use uMake.

What is sent. Only what the feature needs to give you its result:

• Your prompt: what you type, or what you say once Apple's speech recognition has turned it into words (we never receive the recording).
• The photos, sketches, reference pictures, masks and videos you attach or choose.
• Pictures of your canvas or 3D view, and a short text description of your design or board, so the AI can see what you are working on. Design Partner sends the current view with each message, together with the latest messages of the conversation.
• Live AI Preview: while it is on and you keep drawing, the App sends a picture of your canvas (sometimes with a depth or outline picture made from it) and your prompt each time you pause, at most about once a second, and shows you the result. It stops sending when the canvas stops changing, when you leave the editor or turn the preview off, and when your preview credits run out.

Who receives it. The App sends your request to our own AI service (ai.umake.com), which passes it to the provider that runs the feature, using uMake's accounts with them. They receive the content of your request, and not your name, your email address or your uMake user ID. If a photo shows people, or you write personal details into a prompt, the provider receives those too, so please share only what you are comfortable sharing. Our providers are:

• OpenAI (United States): Design Partner's replies and plans, image creation and editing, and reading your pictures and canvas. https://openai.com/policies/privacy-policy/
• Anthropic (United States): a backup for OpenAI's text features when OpenAI is unavailable. https://www.anthropic.com/legal/privacy
• Google (Gemini API): Nano Banana image creation and editing. https://policies.google.com/privacy
• fal (fal.ai, United States): Live AI Preview, and many of the image, video, upscaling, cutout and 3D features. fal runs models made by fal and by other companies, such as Black Forest Labs (FLUX), OpenAI (GPT Image), Google (Nano Banana), MiniMax, Alibaba (Wan), Meta (SAM), Ideogram, Bria, ByteDance (SeedVR), Tencent (Hunyuan 3D), Deemos (Rodin) and Microsoft (TRELLIS), and may pass a request to the company that made the model in order to run it.
• TypeSafe (typesafe.ai): reads the text of requests and of the plans our AI makes (never your pictures) to choose how to handle a request and to check the result.

How they use it. These providers process your content to create the result and send it back to us. Each of them handles what it receives under its own terms and privacy policy, which may allow it to keep the content for a time, for example to detect abuse or to comply with the law.

What we keep. The results you keep are stored in your account (see "Spaces, My Media and your designs" in section 1). Our AI service keeps a result for up to an hour so it can deliver it to you, and keeps records of your use (your user ID, the feature, the time and your IP address) to count your AI credits and to prevent abuse. It also keeps examples of the requests Design Partner planned successfully (the prompt and a short description of the design, without your name or user ID), which we may use to improve Design Partner.

Your choice. Your content goes to these providers only when you use an AI feature, and, for Live AI Preview, only while the preview is on. If you don't want your content sent to them, don't use the AI features; the rest of uMake works without them.

Students. uMake, including its AI features, is for people 13 and older (see "SCHOOLS, STUDENTS AND CHILDREN").

5. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We share information with the service providers who help us run uMake, whom we name below; with Meta, to measure our advertising; with your school or organization if you use uMake through one; and in the specific situations described in this section.

Vendors, Consultants, and Other Third-Party Service Providers. We share your data with third-party vendors, service providers, contractors, or agents (“third parties”) who perform services for us or on our behalf and require access to such information to do that work. Some of them, such as Apple, Google, Microsoft, Meta, LinkedIn and Stripe, also use the information they receive for their own purposes, under their own privacy policies, which we encourage you to read. The third parties we share personal information with are:

• Hosting and storage: Amazon Web Services runs our servers, databases and file storage, in the United States. Vercel runs our websites. Cloudflare provides the domain names of our Services, and protects some of them as their traffic passes through it.
• AI providers: OpenAI, Anthropic, Google, fal and TypeSafe, as described in "HOW DO OUR AI FEATURES USE YOUR INFORMATION?"
• Payments: Apple (purchases in the App), Stripe and Link (purchases on account.umake.com), and Chargebee (a subscription billing service, which receives the name and email address of signed-in accounts).
• Sign-in: Apple, Google and Microsoft, when you choose to sign in with them (see section 7).
• Email: Resend sends our emails. Google Workspace hosts our mailboxes.
• Customer support: an AI assistant helps us read and answer the messages sent to hello@umake.com and the Education plan applications sent through our website.
• Analytics and measurement:
  • Mixpanel receives how you use the App, linked to your account: your user ID, name, email address, how you signed in, your subscription and purchases, and the events described in section 1.
  • Google Analytics for Firebase receives App usage and purchase events.
  • Meta receives App events, such as when you install and open the App and the purchases you make, through the Facebook SDK in the App, and your device's advertising identifier if you allow tracking. We use this to measure our ads; see section 6.
  • Apple tells us which Apple Search Ads campaign led to an install.
  • Google Analytics and PostHog, and on some pages LinkedIn's Insight Tag and Framer's analytics, receive how visitors use our websites (see section 6).

Your school or organization. If you join a school license or a Team, the people who manage it see your name and email address, and can remove you. If your seat includes AI credits, they also see how many of them you have used this month and when you last used them.

Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

Legal Requirements. We may disclose your information where we are legally required to do so, such as to comply with a court order or a lawful request by public authorities, or where it is necessary to protect our rights, your safety or the safety of others.

With Your Consent. We may share your information for any other purpose with your consent.

6. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: Our websites use cookies for analytics and to measure our ads. The App tells Meta about your use of the App and your purchases, to measure our ads; your device's advertising identifier is used only if you allow tracking.

Our websites. Our websites use Google Analytics, PostHog, LinkedIn's Insight Tag and Framer's analytics to understand how visitors use them and, for LinkedIn, to measure our ads; each page uses some of these. They may set cookies, including a cookie of our own (umk_vid) that recognizes your browser for a year. account.umake.com uses only the cookies it needs to sign you in and keep you signed in, and loads Apple's and Google's sign-in on its sign-in pages. Videos in our blog play in YouTube's privacy-enhanced player, which loads only when you press play (the video's preview picture comes from YouTube when the page loads). Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookies Policy: https://www.umake.com/legal/cookie.

The App and Meta. The App includes Meta's Facebook SDK, which sends Meta information about your use of the App, such as when you install and open it and the purchases you make, so that Meta can tell us which of our ads work.

App Tracking Transparency. The App asks whether you allow uMake to track you, as Apple's App Tracking Transparency requires.

• If you allow it, the Facebook SDK also sends Meta your device's advertising identifier.
• If you don't, the App does not access your advertising identifier, but the App events and purchases described above are still sent to Meta.
• You can change your choice at any time in your device's settings under Privacy & Security > Tracking > uMake.

Some US state laws may treat sending this information to Meta as "selling" or "sharing" personal information for advertising. You can ask us not to sell or share your personal information by emailing hello@umake.com.

7. HOW DO WE HANDLE SIGN-IN WITH APPLE, GOOGLE AND MICROSOFT?

In Short: If you sign in with Apple, Google or Microsoft, we receive your name, your email address and an identifier for your account with them.

You can sign in to uMake with Apple, Google or Microsoft, or with an email address and password. When you sign in with one of these services, we receive:

• Apple: your name and email address (or the private relay address Apple makes for you, if you choose to hide yours) and your Apple account's identifier. We keep a token from Apple so that we can revoke uMake's access to your Apple account when you delete your uMake account.
• Google: your name, email address, profile picture and Google account identifier, and, for a Google Workspace account, its domain.
• Microsoft: for a work, school or personal Microsoft account, your name, email address, your account's and your organization's identifiers, and the email domain Microsoft confirms belongs to your organization.

We use this information to create your account and sign you in, to link the ways you sign in to one account, and to recognize when your sign-in belongs to a school or organization (for example, to let you join your organization's Team). We never receive your password for these services, and we never post anything to them. If you sign up with an email address and password, we ask you to confirm your email address.

We will use the information we receive only for the purposes that are described in this privacy notice or that are otherwise made clear to you on the relevant Services. Please note that we do not control, and are not responsible for, other uses of your personal information by Apple, Google or Microsoft. We recommend that you review their privacy notices to understand how they collect, use and share your personal information, and how you can set your privacy preferences on their sites and apps: https://www.apple.com/legal/privacy/, https://policies.google.com/privacy and https://privacy.microsoft.com/privacystatement.

8. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: We store your information in the United States, and our service providers may process it in other countries.

Our servers and your account's storage are located in the United States (Amazon Web Services, Northern California). If you are accessing our Services from outside the United States, please be aware that your information may be transferred to, stored, and processed by us and by the third parties with whom we share your personal information (see "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?"), in the United States and other countries.

If you are a resident in the European Economic Area (EEA), United Kingdom (UK) or Switzerland, then these countries may not necessarily have data protection laws or other similar laws as comprehensive as those in your country. However, we will take all necessary measures to protect your personal information in accordance with this privacy notice and applicable law.

Safeguards for international transfers:

When personal information from the EEA, UK or Switzerland is transferred to other countries, the safeguards used may include the European Commission's Standard Contractual Clauses (with the UK's addendum to them) in a service provider's terms, or a provider's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. You can ask us for more information about these safeguards.

9. HOW LONG DO WE KEEP YOUR INFORMATION, AND WHAT HAPPENS WHEN YOU DELETE YOUR ACCOUNT?

In Short: We keep your information while you have an account. When you delete your account, we delete it and what is linked to it within about half an hour, except for the records listed here.

We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). Most of your information is kept for as long as you have an account with us.

When you delete your account. You can delete your account at any time in the App: Settings > Delete Account.

• Right away, you are signed out on all your devices, and you can no longer sign in to the account.
• About 20 to 25 minutes later (sometimes longer, if a step fails and has to be tried again), we delete your account and everything linked to it: your profile and sign-in methods, your designs and files, your Spaces photos, videos and 3D models, My Media and My Textures, your saved library, your Scene Studio images and clips, your memberships of Teams and school licenses, your school email confirmations and your AI credits. We also ask Apple to revoke uMake's access to your Apple sign-in, delete your profile at Mixpanel, and delete your customer record at Stripe.
• What we keep by design:
  • A record of each purchase (its transaction number, product, amount and dates), without your name or email address, for accounting, tax, refunds and fraud prevention.
  • Billing records that hold our payment providers' reference numbers for you, the school licenses and Teams you bought (they belong to the school or organization), and the invoices and records that Stripe and Apple keep under their own legal obligations.
  • Technical records that hold an identifier for your device but not your name or email address, such as the guest account on your device.
  • Server logs and backups, which we keep for as long as we need them to run and secure the Services, and as the law requires.
• What is not deleted automatically: your customer record at Chargebee (your name and email address), the usage events Mixpanel recorded (we delete your Mixpanel profile, not these events), and the parametric parts you saved, which our AI service stores apart from your account's storage. You can ask us to delete these by emailing hello@umake.com.
• If you owned a Team, its subscription ends at the end of its current period, and its admins are told that the owner deleted their account.

Other retention.

• When you replace a file in your account's storage, we keep the previous version for up to 30 days (90 days for your saved library) so that it can be recovered, and then delete it.
• A school email confirmation lasts 30 days. We delete it 7 days after it expires, or 7 days after it was sent if it was never confirmed. The school email address and statement you confirmed when buying a school license stay with that license.
• Education plan applications are emailed to us and kept in our mailbox for as long as we need them to handle your application and any later questions about it. Personal Education codes are kept by Stripe with the email address they were sent to.
• Our service providers keep what they receive for their own retention periods, which they set or which we set in our accounts with them; the AI providers keep content as described in section 4.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

10. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. For example, your account's photos, videos and models are kept in private, encrypted cloud storage that is reached only through short-lived links. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

11. SCHOOLS, STUDENTS AND CHILDREN

In Short: uMake is for people 13 and older, including students who use it through their school. Schools, colleges and universities can provide uMake to their students and staff, and students can get a free Education plan.

Who can use uMake. You must be at least 13 years old to use uMake. If you are under 18, you need the permission of a parent or guardian, who agrees to our terms on your behalf. This applies to students who use uMake through their school too.

Children under 13. uMake is not for children under 13, including through a school license. A school that wants to provide uMake to students under 13 must agree this with us in writing first.

School licenses. Schools, colleges and universities ("schools") can buy uMake licenses for their students and staff to use in teaching and learning. Students and staff join a license by signing in with their own uMake account and opening the school's join link. The people who manage the license see each member's name and email address, and can remove members. Accounts on a school license or the Education plan are handled like any other account, as this notice describes, including the analytics and advertising measurement in sections 5 and 6.

Schools' privacy obligations. A school that provides uMake to its students is responsible for meeting the privacy rules that apply to it, such as telling students and parents about uMake and getting any consent its rules or local law require. For the information a school manages through its license, such as who has a seat, we act on the school's behalf: we use it to provide the license to the school and its members, and we remove a member's seat when the school asks. A US school may treat uMake as a "school official" under the Family Educational Rights and Privacy Act (FERPA) for that information. Students, and their parents where the law gives them the right, can contact their school or us to exercise their rights. Schools that need a data processing agreement, or a student data privacy agreement under a state law, can contact us at hello@umake.com.

The Education plan. Students can get a free Education plan with a teacher's class link, a school license's code, or by applying on our website. When you apply, we use what you tell us (your name, school email address, school, country and level of study) only to check your application and email you about it. An AI assistant helps us review applications. We email your Education code to you through Resend, and Stripe keeps the code with your email address.

If we learn that we have collected information from a child under 13 without the consent the law requires, we will delete it. If you believe we may have such information, please contact us at hello@umake.com.

12. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: In some regions, such as the European Economic Area (EEA), United Kingdom (UK), Switzerland and Canada, and in some US states, you have rights that allow you greater access to and control over your personal information. You can delete your account at any time in the App.

In some regions (like the EEA, UK, Switzerland and Canada), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; and (iv) if applicable, to data portability. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by contacting us by using the contact details provided in the section “HOW CAN YOU CONTACT US ABOUT THIS NOTICE?” below.

We will consider and act upon any request in accordance with applicable data protection laws.

If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your local data protection supervisory authority. You can find their contact details here: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en (EEA) and https://ico.org.uk (UK).

If you are located in Switzerland, the contact details for the data protection authorities are available here: https://www.edoeb.admin.ch/edoeb/en/home.html.

Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw it in your device's settings (for tracking and notifications), or by contacting us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below.

However, please note that this will not affect the lawfulness of the processing before its withdrawal, nor when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.

Opting out of marketing and promotional communications: You can turn off notifications about new tools and ideas in your device's settings. If we send you marketing emails, you can unsubscribe at any time by clicking on the unsubscribe link in them, or by contacting us using the details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below. However, we may still communicate with you — for example, to send you service-related messages that are necessary for the administration and use of your account, to respond to service requests, or for other non-marketing purposes.

Account Information

If you would at any time like to review or change the information in your account or terminate your account, you can:

• Change your name and profile picture in the App's settings.
• Delete your account in the App: Settings > Delete Account (see "HOW LONG DO WE KEEP YOUR INFORMATION, AND WHAT HAPPENS WHEN YOU DELETE YOUR ACCOUNT?").
• Manage a subscription bought in the App in your Apple account's settings, and one bought on account.umake.com at account.umake.com.
• Email us at hello@umake.com for a copy of your information, or for anything you can't do yourself.

Cookies and similar technologies: Most Web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove cookies or reject cookies, this could affect certain features or services of our Services. For further information, please see our Cookies Policy: https://www.umake.com/legal/cookie.

If you have questions or comments about your privacy rights, you may email us at hello@umake.com.

13. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this privacy notice.

14. DO RESIDENTS OF CALIFORNIA AND OTHER US STATES HAVE SPECIFIC PRIVACY RIGHTS?

In Short: Yes, if you are a resident of California or of another state with a consumer privacy law, you are granted specific rights regarding access to your personal information.

California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us using the contact information provided below.

If you are under 18 years of age, reside in California, and have a registered account with Services, you have the right to request removal of unwanted data that you publicly post on the Services. To request removal of such data, please contact us using the contact information provided below and include the email address associated with your account and a statement that you reside in California. We will make sure the data is not publicly displayed on the Services, but please be aware that the data may not be completely or comprehensively removed from all our systems (e.g., backups, etc.).

CCPA Privacy Notice

The California Code of Regulations defines a "resident" as:

1. every individual who is in the State of California for other than a temporary or transitory purpose and
2. every individual who is domiciled in the State of California who is outside the State of California for a temporary or transitory purpose

All other individuals are defined as "non-residents."

If this definition of "resident" applies to you, we must adhere to certain rights and obligations regarding your personal information.

What categories of personal information do we collect?

We have collected the following categories of personal information in the past twelve (12) months:

• A. Identifiers. Name, email address, account name, user ID, device identifiers, Internet Protocol address, and your advertising identifier if you allow tracking. Collected: YES.
• B. Personal information categories listed in the California Customer Records statute. Name, contact information, school or organization, and, for invoice orders, a billing address. Collected: YES.
• C. Protected classification characteristics under California or federal law. Gender and date of birth. Collected: NO.
• D. Commercial information. Transaction information, purchase history and subscription status. Collected: YES.
• E. Biometric information. Fingerprints and voiceprints. Collected: NO.
• F. Internet or other similar network activity. How you use the App and our websites. Collected: YES.
• G. Geolocation data. Precise device location. Collected: NO.
• H. Audio, electronic, visual, thermal, olfactory, or similar information. The photos, videos and pictures you add to the Services. Collected: YES. (We do not receive recordings of your voice.)
• I. Professional or employment-related information. The organization you work for and your work email address, if you use a Team. Collected: YES.
• J. Education Information. Your school, your school email address and your membership of a school license or the Education plan. Collected: YES.
• K. Inferences drawn from other personal information. Inferences drawn from any of the collected personal information listed above to create a profile or summary about, for example, an individual’s preferences and characteristics. Collected: NO.
• L. Sensitive personal information. Your account login (email address and password). Collected: YES. We use it only to provide the Services, and not to infer characteristics about you.

We may also collect other personal information outside of these categories in instances where you interact with us in person, online, or by phone or mail in the context of:

• Receiving help through our customer support channels;
• Participation in customer surveys or contests; and
• Facilitation in the delivery of our Services and to respond to your inquiries.

How do we use and share your personal information?

More information about our data collection and sharing practices can be found in this privacy notice, in "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?" and "DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?", and in our Cookies Policy: https://www.umake.com/legal/cookie.

You may contact us by email at hello@umake.com, or by referring to the contact details at the bottom of this document.

If you are using an authorized agent to exercise your right to opt out we may deny a request if the authorized agent does not submit proof that they have been validly authorized to act on your behalf.

Will your information be shared with anyone else?

We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Each service provider is a for profit entity that processes the information on our behalf.

We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be "selling" of your personal information.

In the preceding twelve (12) months, to measure our advertising, we have disclosed identifiers (such as your user ID, or your device's advertising identifier if you allowed tracking), commercial information (your purchases) and internet or other network activity (your use of the App) to Meta and to Branch (an advertising measurement service we no longer use), and internet or other network activity on our websites to Google and LinkedIn. Some state laws may treat these disclosures as "selling" or "sharing" personal information. You can ask us not to sell or share your personal information by emailing hello@umake.com. We have disclosed the other categories of personal information listed above to the service providers named in "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?", and to Twilio SendGrid, which sent our emails before Resend, for a business or commercial purpose.

Your rights with respect to your personal data

Right to request deletion of the data — Request to delete

You can ask for the deletion of your personal information, or delete your account yourself in the App. If you ask us to delete your personal information, we will respect your request and delete your personal information, subject to certain exceptions provided by law, such as (but not limited to) the exercise by another consumer of his or her right to free speech, our compliance requirements resulting from a legal obligation, or any processing that may be required to protect against illegal activities.

Right to be informed — Request to know

Depending on the circumstances, you have a right to know:

• whether we collect and use your personal information;
• the categories of personal information that we collect;
• the purposes for which the collected personal information is used;
• whether we sell or share your personal information to third parties;
• the categories of personal information that we sold or disclosed for a business purpose;
• the categories of third parties to whom the personal information was sold or disclosed for a business purpose;
• and the business or commercial purpose for collecting or selling personal information.

In accordance with applicable law, we are not obligated to provide or delete consumer information that is de-identified in response to a consumer request or to reidentify individual data to verify a consumer request.

Right to Non-Discrimination for the Exercise of a Consumer’s Privacy Rights

We will not discriminate against you if you exercise your privacy rights.

Verification process

Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. These verification efforts require us to ask you to provide information so that we can match it with information you have previously provided us. For instance, depending on the type of request you submit, we may ask you to provide certain information so that we can match the information you provide with the information we already have on file, or we may contact you through a communication method (e.g., phone or email) that you have previously provided to us. We may also use other verification methods as the circumstances dictate.

We will only use personal information provided in your request to verify your identity or authority to make the request. To the extent possible, we will avoid requesting additional information from you for the purposes of verification. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes. We will delete such additionally provided information as soon as we finish verifying you.

Other privacy rights

• You may object to the processing of your personal information.
• You may request correction of your personal data if it is incorrect or no longer relevant, or ask to restrict the processing of the information.
• You can designate an authorized agent to make a request under the CCPA on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with the CCPA.
• You may ask us not to sell or share your personal information, by emailing hello@umake.com. You can also stop the App from using your device's advertising identifier in your device's settings (Privacy & Security > Tracking).

To exercise these rights, you can contact us by email at hello@umake.com, or by referring to the contact details at the bottom of this document. If you have a complaint about how we handle your data, we would like to hear from you.

Other US states

If you live in another US state with a consumer privacy law, such as Virginia, Colorado, Connecticut, Utah, Texas or Oregon, you may have similar rights: to know and get a copy of your personal information, to correct it, to delete it, and to opt out of its sale, of targeted advertising and of profiling. You can exercise them by emailing hello@umake.com. If we decline your request, you can appeal by replying to our answer; if we deny the appeal, you can contact your state's attorney general.

15. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this privacy notice from time to time. The updated version will be indicated by an updated "Effective date" and the updated version will be effective as soon as it is accessible. If we make material changes to this privacy notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this privacy notice frequently to be informed of how we are protecting your information.

16. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may email us at hello@umake.com.

Our mailing address is:
uMake, Inc.
550 S California Ave
Ste 1
Palo Alto, CA 94306
United States

17. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, change that information, or delete it in some circumstances. You can delete your account and its data yourself in the App (Settings > Delete Account). To request to review, update, or delete your personal information, email us at hello@umake.com. If you use uMake through your school, you can also ask your school.