Privacy Policy

1. Who is responsible#

This policy describes the present application and the conditions for future media features. Controller name, address, country and privacy contact: Information not provided. A representative or data protection officer, if legally required: Information not provided. These details and the real hosting arrangements must be completed before public collection of personal data begins.

The GDPR and other privacy laws apply when their territorial and material conditions are met. This page does not assert that a single law applies to every user or that publication of a policy alone establishes compliance.

2. Data used by the current application#

A selected photo first opens on your device. Saving a project prepares a smaller JPEG and preview without the original file’s metadata. In an account, those prepared images are sent to LIA when you save. In guest mode, they are stored in that browser. Selecting one file does not give LIA access to the rest of your photo library.

• Account: Telegram user ID, first and last name where supplied, username where supplied, your chosen LIA display name and account timestamps. Authentication does not request your contact list, private chats or phone number.
• Projects and library: titles, descriptions, selected images, image previews, saved world IDs, an unfinished text draft and the reduced-motion preference attached to an account.
• Generation, when used: the submitted description and prepared reference image, title, selected settings, request and provider identifiers, processing state, timestamps, error category, usage information and the resulting 3D files and previews.
• Security: protected session records, expiry times, one-time authentication records, the version and time of accepted terms, and pseudonymous daily generation counters used to enforce limits. Your IP address is processed for network delivery and request rate limits; the application database does not maintain a profile of IP addresses or browser fingerprints.
• Device preferences: theme, viewer quality, motion preference, guest bookmarks and drafts, guest projects and the local notice choice. These are explained in the Cookie Policy.

3. Purposes and legal bases#

Where GDPR rules apply, the intended basis for authentication, storing your projects and carrying out a generation you request is performance of the service agreement. Protecting sessions and preventing abuse relies on legitimate interests in service security, subject to a balancing assessment. Processing required by a specific law relies on that legal obligation. Optional processing that requires consent must have a separate, freely given choice; it is not covered by accepting the terms.

These purposes do not permit unlimited reuse. The operator must confirm the applicable bases and required assessments before launch. LIA does not use project materials for behavioural advertising or independently train a general-purpose model on them. World Labs has its own processing and reuse terms, described below. There is no advertising mailing list bundled with account creation.

Account identity is necessary for account features. You can visit public spaces without an account. An image is required only when you choose a photo project. If required information is not provided, the corresponding feature cannot operate; unrelated optional choices must remain optional.

4. World generation and other media#

When enabled, an explicit world-generation request sends its description, title, selected settings and prepared JPEG reference, if any, to World Labs Technologies, Inc. to produce a 3D world. LIA also exchanges technical job identifiers and reads the result. LIA does not send your Telegram identity, chats, contact list or sign-in credentials as part of this generation request. Do not put such information in the text or photograph yourself.

World Labs publishes terms that permit content use for service development and model training, with a prospective opt-out for eligible paid accounts. LIA’s operator must review and configure the applicable provider account arrangements before enabling generation. A private world setting controls access; it is not a training opt-out or a zero-retention guarantee. Do not assume a stronger protection unless LIA expressly confirms the arrangement that applies to the service you use.

Saving a project alone does not send it to World Labs. New providers or materially different processing require updated disclosure and any additional permission required by law before transfer. Video and audio processing are not enabled; if introduced, their inputs may contain people, places, voices and personal information and will require their own controls.

LIA does not currently offer biometric identification, voice enrolment or emotion analysis. A photo or recording is not automatically special-category biometric data, but processing it to identify someone uniquely can create additional legal requirements. Sensitive or regulated processing must not be enabled without a lawful basis and appropriate safeguards.

5. Recipients and international transfers#

Telegram supplies authentication information and operates its own platform under its own privacy policy. LIA’s hosting and database providers would process data needed to run the configured service under appropriate arrangements. Their names, hosting locations and relevant international-transfer safeguards: Information not provided.

World Labs Technologies, Inc. receives the materials for world-generation jobs only when that service is enabled and you explicitly start a job. Provider processing locations and the applicable contractual transfer safeguards: Information not provided. These must be confirmed and disclosed before public activation. No separate image, video or audio generation provider is connected.

Authorised access may be needed to resolve a user request, investigate a security incident or comply with a valid legal duty. Access should be limited to what the task requires. Private projects are not automatically published. There is no end-to-end-encryption promise that would prevent all authorised server-side access.

Where data-protection law restricts cross-border transfers, a permitted mechanism and any necessary assessment must be in place before the transfer. Hosting countries and safeguards must be disclosed, not inferred from the user’s language or the domain name.

6. Retention and security#

Account materials remain in the active database while you keep the account or until you delete the relevant data. Account deletion removes linked projects, library data, acceptance records and sessions from that database. Sessions expire after at most 24 hours or after two hours of inactivity; web-login transactions expire after five minutes.

Guest storage remains until you or the browser remove it. Generated results and their request records are stored separately from project drafts; their deletion and provider cleanup are explained in Storage & Retention. Infrastructure logs, backup expiry and provider retention depend on the deployment and applicable arrangements. Deleting an active record is not a promise that every independent backup or copy disappears instantly.

The implementation checks Telegram proofs on the server, uses protected session cookies and verifies access to private data. No security measure guarantees that incidents can never happen. Any legally required breach notices must be handled by the operator within the applicable deadlines.

7. Your rights and choices#

Depending on the law and circumstances, you may request access, correction, deletion, restriction or portability of personal data, or object to processing. Where consent is used, you may withdraw it without making earlier lawful processing unlawful. You may complain to the competent data-protection authority. The conditions and exceptions for each right remain applicable.

Profile settings let you change your LIA display name, download your account data, end sessions and delete the account. These controls do not replace rights requests about information outside the account export. Privacy contact: Information not provided. A working channel must be published before launch; do not send identity documents or private materials to an invented or guessed email address.

Where GDPR applies, requests are normally answered within one month. A permitted extension for complexity or volume requires notice within that initial month. Identity checks must be proportionate. Fees or refusals require a lawful reason, rather than being the default.

8. Age and automated decisions#

LIA is intended for adults aged 18 or older who have reached legal majority. The age checkbox is a declaration, not a verified identity check. A report that a child is using the service must be handled through the published privacy channel when established.

The current application does not make solely automated decisions with legal or similarly significant effects about employment, credit, housing, health or other eligibility. Technical request limits protect availability and account access. Any future moderation or profiling with different effects must be assessed and explained before it is introduced.

9. Changes to this policy#

The revision date appears above. Material changes to purposes, recipients or choices require a clear notice and any additional permission required by law. A new date on this page is not a substitute for obtaining valid consent where consent is necessary.