This policy has not been reviewed by a lawyer. It describes, in plain English, what the system really does with your data. If any part conflicts with the law, the law wins.
1. Who is responsible for your data
ColiWorks is run by Matheus Ballesteros, an individual based in Brazil, who is the controller of the data described here — under the GDPR and the UK GDPR, if you are in the European Economic Area or in the United Kingdom.
Contact for privacy matters: contact@coliworks.com. Every request about personal data is received and answered at that address.
Customers in Brazil are covered by the Portuguese version, at coliworks.com/privacidade.
2. What we collect, and on what basis
We collect only what the service needs to work. For each item, the legal basis:
- Name and email — to create and keep your account, and to talk to you about the service. If you sign in with Google, Google sends us your name, your email, the address of your profile picture and an account identifier. We use only the name and email; the rest stays in the sign-in record at Supabase. *Basis: performance of the contract.*
- Password — stored only as a cryptographic hash. We cannot see your password. *Basis: performance of the contract.*
- Payment data — your card number never touches our servers: it is processed directly by Stripe. We receive only the result of the charge and the last digits. *Basis: performance of the contract.*
- Billing details (such as full name, phone and address), when you subscribe — to issue receipts and meet tax obligations. The address is stored encrypted. *Basis: legal obligation.*
- Your country, worked out from your IP address when you sign up or pay — to show prices in your currency, write to you in your language and show you the right version of these documents. We keep the country, not the IP address. *Basis: performance of the contract.*
- The pieces and projects you create — so you can save and open them again. *Basis: performance of the contract.*
- Usage records (when you sign in, which screens you open, what you export) — to run the service, detect abuse and understand what needs to improve. *Basis: legitimate interests.*
- IP address — kept for 1 hour, only to stop repeated sign-in attempts. Then it is deleted. *Basis: legitimate interests (security).*
- If you request access through the form: the name, email, Instagram and WhatsApp you type in, to answer your request. *Basis: steps at your request before a contract.*
We do not collect special category data (racial or ethnic origin, religion, political opinions, health, biometrics) and we do not sell or share personal information with anyone, under any circumstances — including as "sale" or "sharing" is defined in California law.
3. How we use it
We use the data to: keep your account and your pieces; process payments and charges; send messages about the service; answer your support requests; measure what works in the product; and meet legal obligations.
Promotional messages are sent only if you agree to receive them, and every email has an unsubscribe link that works in one click. Service messages — receipts, payment notices, changes to the terms — do not depend on your agreement, because they are part of the contract.
4. Who we share it with
We do not sell or hand over data. We share it only with the suppliers the service needs to exist, and each one gets only what it needs:
- Stripe (payments) — name, email and transaction data. It processes your card.
- Supabase (database and sign-in) — where your account and your pieces are stored.
- Vercel (hosting) — where the application runs; it processes the requests you make.
- Resend (email delivery) — your email address and the content of the messages we send you.
- Google — only if you choose to sign in with Google.
- Google Analytics (visit measurement) — only if you accept in the notice on coliworks.com: pages viewed, where the visit came from, device and browser, approximate country and a random identifier stored in a cookie. It does not receive your name, email or tax ID.
- Meta (pixel, ad measurement) — only if you accept, in the same notice: pages viewed, where the visit came from, device and browser and a random identifier stored in a cookie; and, when they happen, the access request, the start of a checkout and the purchase, with its value. These events may also travel through Meta's server (Conversions API). They are used to measure and target ColiWorks ads. We do not send Meta your name, email, phone number or tax ID.
- Microsoft Clarity (how the studio is used) — in the studio (studio.coliworks.com), as the Terms of Use say, and you can turn it off in Settings → Privacy: clicks, scrolling and mouse movement on the studio screens, device and browser, approximate country and a random identifier stored in a cookie. Your name and email are masked, and the 3D piece does not appear in the recording. It shows us where people get stuck. Microsoft also uses this data under its own rules, including to improve its products and advertising (Microsoft's privacy statement: microsoft.com/privacy).
We may also share data when the law requires it or a court orders it.
5. Your data crosses borders
We are based in Brazil, and the suppliers above run servers outside your country, mainly in the United States and the European Union. So your data is transferred internationally.
For transfers out of the EEA and the UK, we rely on our suppliers' Standard Contractual Clauses approved by the European Commission (and the UK addendum). You have the right to know this before you use the service, which is why it is written here in plain sight.
6. How long we keep it
- Account and pieces: while your account exists, and for up to 30 days after you delete it.
- IP address from sign-in attempts: 1 hour.
- Tax and payment records: 5 years, as tax law requires.
- Records of accepting the terms: as long as they may be needed to show what was agreed.
- Access requests that never became an account: until you ask us to delete them.
When those periods end, the data is deleted or anonymised.
7. Security
Access to the database is restricted by rules that keep each person's data apart. The billing address is stored encrypted. Communication with the service is always encrypted (HTTPS).
No system is immune to incidents. We do not promise absolute security — we promise the measures above and honest communication if something happens, as described in section 11.
8. Your rights
You can, at any time: access the data we hold about you; correct incomplete or wrong data; ask us to delete it; restrict or object to processing based on legitimate interests; receive your data in a portable format; and withdraw consent where processing relies on it.
To use any of them: contact@coliworks.com. We answer within 15 days.
⚠️ Some requests have legal limits: we cannot delete data the law requires us to keep (tax records), and we will tell you clearly if that is the case.
9. Cookies and local storage
We use the minimum:
- Session cookie — keeps you signed in. Without it, there is no sign-in.
- Local storage in your browser — keeps the piece you are working on and your preferences, so you do not lose your work.
- Where your visit came from — which site or link brought you, to know what works in our promotion. It does not identify you and is not shared.
- Visit and ad measurement (Google Analytics and the Meta pixel) — only on the promotion page (coliworks.com) and only if you accept in the notice on your first visit; the basis is your consent. Detailed data stays in Google Analytics for 2 months; pixel data, for Meta's period. Declining changes nothing in the service, and you can change your mind at any time through the Cookie settings link in the page footer.
- Studio usage measurement (Microsoft Clarity) — only in the studio, as the Terms of Use say; the basis is our legitimate interest in improving the studio. Data stays in Clarity for Microsoft's period. Turning it off changes nothing in the service: it is a switch in Settings → Privacy, whenever you want.
There is no advertising pixel inside the app — Meta's stays on the promotion page.
The list of every cookie, with its name, what it is for and how long it lasts, is in the Cookie Policy (coliworks.com/cookie-policy).
10. Children
ColiWorks is not meant for anyone under 18, and we do not knowingly collect data from children. If we find an account belonging to a minor without a parent's or guardian's permission, it will be closed and the data deleted.
11. If an incident happens
If a security incident could put you at real risk, we will tell you and the competent data protection authority, within the time and in the way the law requires, saying what happened, which data was affected and what we are doing about it.
12. Changes to this policy
We may update this policy. When the change is important, we tell you by email and publish a new version, with its date. The current version is always on this page.
13. Complaints
If you think we have handled your data wrongly, talk to us first — contact@coliworks.com. You can also complain to the data protection authority of the country where you live (in the UK, the Information Commissioner's Office).