Privacy Notice

CRATEMIX STUDIO PRIVACY NOTICE
Version 2026-10-28.1 | Effective October 28, 2026

1. Controller and contacts

GRENARC LLC, Virginia, United States, operates CrateMix Studio and is responsible for the account and service processing described here. Contact contact@grenarc.com for privacy or legal requests and contact@cratemixstudio.com for product support. This notice describes current processing rather than promising that every future feature has been implemented.

2. Account, licensing, and security information

We process the email address, display name, optional profile names, verification and approval state, license and subscription records, and the agreement choices needed to administer your account. Passwords are stored as one-way password hashes, not readable passwords. Authentication tokens, browser sessions, and MFA credentials are handled as security-sensitive data. Agreement records identify the version and content accepted, the time, and the source of the action.

We process necessary network and security information, such as IP addresses used for short-lived rate limits, abuse prevention, and country-level availability checks. Country lookup uses a local database; a visitor's IP is not sent to a geolocation API for each request. We do not infer your ethnicity, ancestry, or nationality from your name or language. Geolocation can be inaccurate; support can review a disputed result.

Necessary account and software-delivery processing is used to provide the service or take steps you request before a contract. Security, fraud prevention, proportionate service administration, and defense of legal claims rely on legitimate interests where that basis is available and appropriate. Legal duties may require additional processing. We do not treat acceptance of an account contract as permission for every optional data use.

3. Local projects and external connections

Your local models, textures, materials, paint strokes, and project files are not automatically uploaded to our backend. They are processed and saved on your computer. Account and update requests do not contain your project files. A connected AI provider or other external tool may receive data that you deliberately send through that integration; its own policies also apply. Check those connections and their permissions.

We do not currently run an automatic model-training system. The current data contribution service accepts approved text and metadata rather than automatic model or texture uploads. If a future feature needs a new category of data or a new purpose, we will explain it and obtain any required permission before that use begins.

4. Optional feedback and training contributions

You choose separately whether to share approved result feedback and whether approved contributions may be reviewed for training. Preferences suggested during signup are drafts only. A preselected box is not treated as permission to upload data or use it for training.

Optional use requires an active, specific confirmation for that purpose. Individual submissions also require your explicit approval, and training eligibility requires review. You can decline without losing ordinary account or software access. You can change or withdraw optional permissions through Data choices, delete your own submissions, or contact us. Withdrawal stops new use and future eligible dataset exports for that purpose; it does not make an earlier lawful use unlawful.

Where consent is the applicable legal basis, we retain evidence of the permission and its withdrawal. We do not sell personal information or use submitted projects for advertising. No model-training run is implied merely because a contribution was accepted into a review queue. Before any future training feature, we will provide the relevant information and a way to exercise applicable rights rather than promise that every trained model can automatically be reversed.

5. Support

When you open a support issue, we process the information you choose to submit and the conversation needed to respond. Support content is stored separately from training contributions and is not automatically included in training datasets. We do not automatically attach models, textures, screenshots, or diagnostic logs. Avoid sending passwords, MFA codes, or unnecessary personal or confidential information.

Authorized staff may access support information to resolve the issue and administer the service. Internal staff notes are not shown as public conversation messages. You may still make support and privacy requests if software access is pending, suspended, or unavailable in your region, subject to reasonable identity verification.

6. Cookies, email, and updates

The website uses necessary session and request-security cookies, including protection against forged requests. Browser sessions are configured to expire after eight hours and when the browser closes, subject to normal browser behavior. The current site does not use advertising trackers or third-party analytics pixels.

Google Workspace is used for verification, password-reset, and other service email. Feature-announcement marketing requires its own appropriate choice and is not authorized by a feedback or training checkbox. The application may check for a published update using a small authenticated request. Downloads require your action and applicable account access; no project upload is part of an update check.

7. Service providers and locations

The current application backend and database run on Hetzner infrastructure in Germany. Google Workspace handles service email and may process it in locations where Google operates. Authorized providers process information needed for their service; their processing terms and any applicable international-transfer protections must be considered separately from the server's physical location.

GRENARC is established in the United States, so authorized administration or processing can involve the United States as well as Germany. Where applicable law requires a safeguard for an international transfer, we must use a valid applicable mechanism rather than assume that a German server alone resolves the issue. Contact contact@grenarc.com for information about the arrangements applicable to your data.

We may disclose information where lawfully required, to protect rights and security, or as part of a legitimate corporate transaction with appropriate protections. We do not disclose passwords in readable form or give every administrator unrestricted access to every data function. Roles and recent MFA protect administrative functions.

8. Retention and deletion

We retain account and license information while needed to provide and administer your account and to satisfy applicable legal duties. Optional contribution content is eligible for its approved purpose only while the required permission is current. Withdrawal blocks new submissions and future eligible exports for that purpose. You can separately delete your own submissions or request erasure; limited evidence may still be needed for the purposes described below. Support conversations are retained while needed for assistance, follow-up, proportionate security, and legitimate claim handling; resolving a ticket is not the same as deleting it.

Minimal agreement, consent, and security evidence may need to be retained separately where reasonably necessary to demonstrate authorization, meet a legal duty, or establish or defend a claim. We assess such retention for its purpose and applicable legal period instead of keeping all content indefinitely by default.

Encrypted database backups are restricted to recovery and normally rotate through seven daily snapshots. Deletion from a live database may therefore precede removal from rotating backups. If a backup is restored, applicable deletion and withdrawal instructions must be reapplied. A legal preservation requirement can limit erasure of particular information; we will explain an applicable exception when responding to a request where the law requires it.

9. Your rights and choices

Depending on applicable law, you may request access, correction, erasure, restriction, portability, information about processing, or object to processing based on legitimate interests. You may withdraw consent for optional use without affecting earlier lawful processing. Use the account controls where available or email contact@grenarc.com. You do not need an active paid license to make a privacy request.

We may reasonably verify identity before releasing or erasing information. Under the GDPR, we generally respond within one month and explain an extension where the law permits one. You may complain to the supervisory authority competent for your situation, including where you live, work, or believe a violation occurred. Nothing in a software agreement removes non-waivable data-protection rights.

We do not currently make decisions with legal or similarly significant effects about you solely through a model-training system. Account and license rules are administrative access conditions; you can contact support for review of an incorrect approval, access, or location result.

10. Young users and changes

The service is intended for adults, at least 18 and of legal majority where they live. We do not intentionally offer accounts to children. Contact us if you believe a child has provided personal information so we can assess and address it.

We version this notice and present material changes. A policy revision does not itself authorize a new optional purpose. Current legal and privacy contact: contact@grenarc.com.