Privacy policy

Sirpam 3D Labs AR decides how account and guest information is used. For privacy questions or complaints, contact:

Seller

Gunapal G, trading as Sirpam 3D Labs AR

Address

Perambalur, Tamilnadu.

Email

support@sirpam3dlabs.in

Phone

+91 97893 91798

Grievance officer

Gunapal G

When a studio uploads its clients' photos and videos, the studio decides why they are used and is responsible for asking its clients; we store and play them on the studio's behalf. Clients can still contact us directly about anything that shows them.

• Email and sign-in details (password, or your Google sign-in), and your authenticator-code setup if you turn it on: to sign you in and keep the account safe.
• Name, studio name, phone, city and GSTIN, if you add them: for receipts, to contact you about payments and support, and (studio name and logo only) to show on your guests' scan page.
• Photos, videos, voice notes, titles, client names and studio logo you upload: to make the tracking file, prepare the video, make print files and play the living photo to people who scan.
• Credits, requests, payments, receipts and hosting dates: to sell and apply credits, send receipts and keep the records tax law asks for.
• Messages and reports you send us: to answer you and handle complaints.
• Which version of our terms you accepted, and each photo consent with its date: to show we asked.
• A one-way code made from your email, only if you received a free trial (it can't be turned back into the email): so each person gets the free trial only once.

We don't sell information, don't show adverts and don't build profiles of anyone.

The microphone is used only when you press record for a voice note. The recording is made into the video for that photo in your browser and stored like any other video.

Payments made online are handled by Razorpay. We never see your card number, UPI PIN or bank password; we receive the payment reference, amount and status.

Guests don't need an account and we don't ask for a name, email or location.

• The camera picture is used only inside your browser to find the print. Nothing from the camera is recorded or sent.
• To show owners how their prints are enjoyed, we note when the page opened, the camera started, the photo was found and sound was turned on, with a random code stored in your browser, the kind of device (iPhone, Android or computer) and whether you came from the QR code or a link.
• To stop automated traffic, we keep a scrambled code made from your network address that changes every day and is removed after 7 days. Your network address itself is never stored by us.
• The try-out page works entirely on your device; your photo and video are never uploaded.

Each time a living photo is made, the person uploading confirms that the people shown agreed, that a parent or guardian agreed for any child, and that they have the right to upload it. We record that confirmation with its date. Studios must explain to their clients how living photos are shared.

Anyone with the QR code or link can watch, and links can be forwarded. We never put a living photo on our public Examples page unless its owner asks and we approve it.

If you appear in a living photo and want it taken down, you don't have to go through the studio: report it to us (there's a link on every scan page). Intimate images and impersonation are handled within 2 hours.

Accounts are for adults (18+). Children may appear in family or studio media only with a parent's or guardian's agreement, confirmed by the uploader. We don't track or monitor children's behaviour, and we never use anyone's data, children's least of all, for advertising or profiling.

We use the visitor statistics built into Lovable, the platform this website runs on, to see which pages are used and fix problems. It uses no cookies, stores nothing on your device, doesn't keep IP addresses and doesn't identify visitors. Lovable collects this data for us. Lovable's privacy policy explains how it handles it.

It records the pages visited, where visitors came from, their country, browser, operating system and device type, how long they stay, how fast pages load, errors, and which buttons and links are clicked. All of this is recorded for every visitor, without cookies and without identifying anyone. Detailed data is kept for 90 days and daily summaries for a year.

On our public pages only (home, pricing, studios, families, help and similar, plus the contact, report and try-out pages for Google Analytics), we also use Google Analytics to count visits and Microsoft Clarity to see how pages are used: clicks, scrolling and mouse movement, with anything you type hidden. They never run on your account, the admin panel, scan pages, proof links or sign-in, and we send them the page's address without anything after the "?".

Both set cookies only if you allow analytics. Visitors in the EU, the UK, Switzerland and Canada are asked first; everyone can say no or change their mind with "Cookie settings" at the bottom of every page, and a browser privacy signal (Global Privacy Control) counts as no. Without your yes, Google Analytics sends only cookieless counts and Clarity doesn't run. Google and Microsoft handle this data under Google's privacy policy and Microsoft's privacy statement. We don't use either for advertising.

This is separate from the scan counts owners see, described under "Guests who scan".

• Lovable Cloud runs the website, database, private file storage, sign-in and sign-in emails.
• Lovable provides the visitor statistics described above.
• Google (Google Analytics) and Microsoft (Clarity), for the visitor statistics on public pages described above.
• Google, if you choose to sign in with Google.
• Google Drive, only if you connect it. When you pick files, your browser loads Google's file picker from Google. Sirpam AR asks only for access to files it saves or that you pick (never the rest of your Drive), uses it only to bring in the videos you choose and to save copies you ask for, and keeps the Google key encrypted. Disconnect any time in Settings → Google Drive or in your Google account. Use of information received from Google follows the Google API Services User Data Policy, including its Limited Use requirements.
• Razorpay, for online payments. When you pay, your browser loads Razorpay's payment window from Razorpay, which receives the details you enter there and may collect device and network details and store its own data in your browser to prevent fraud, under Razorpay's privacy policy.
• Google Fonts, only when you make print files with a title in an Indian script other than Tamil: your browser downloads the font to draw the title. The website's own fonts, including Tamil, are served from our site.

These providers may process information outside India. We share only what each one needs, and they protect it under their own security and privacy commitments. Their systems may keep short technical logs (including network addresses) for security.

Our own pages set no cookies. If you allow analytics, Google Analytics and Microsoft Clarity set theirs (names starting with _ga, _clck and _clsk). We keep these small items in your browser's storage:

• Your sign-in session, so you stay signed in (only if you sign in).
• A random visit code, used to count scans without knowing who you are.
• The language you chose on a scan page.
• The PIN you typed for a PIN-protected living photo, until you close the tab.
• The name you typed when reviewing a studio's proof link, so you don't have to type it again.
• Which notices you closed, so they don't come back.
• Your cookie choice (analytics yes or no): a no is kept for 6 months and a yes for a year, then we ask again.
• The page you were on before signing in, removed once you're back.
• For admins only: the time of last activity, to lock the admin panel after 30 idle minutes.

You can clear these at any time in your browser settings; you'll then need to sign in again.

• Photos and videos: while hosted, then deleted automatically 30 days after hosting ends. Replaced files, and uploads that were never used in a living photo, are deleted within a day or two. Deleting a living photo removes its files at once.
• Scan records: kept with the living photo and deleted with it. The daily network code is removed after 7 days.
• Visitor statistics: detailed data for 90 days, daily summaries for a year.
• Google Analytics: visitor-level data for 2 months. Microsoft Clarity: page recordings for about 30 days, summaries for up to 13 months.
• Messages to us: deleted after 2 years.
• Living photos we take down for breaking the rules: a private copy of the photo, video and words is kept for 180 days as the law asks (longer only if police or a court ask us to), then deleted — even if you delete the living photo or your account sooner.
• Reports about content: the case is kept, but the reporter's name, email and message are removed 180 days after it's closed.
• Our admin activity log: kept for 12 months, then deleted.
• Payments and receipts: kept as long as tax and accounting law requires (up to 8 years).
• Your account: until you ask us to close it. We then delete it and its media, keeping only payment records and, if you had a free trial, the one-way trial code.

Photos and videos sit in private storage and are only handed out through short-lived links. Each account's data is walled off at the database. You can add an authenticator code, and the admin panel always needs one. If a breach affects you, we'll tell you without delay, report it to CERT-In within 6 hours of noticing it, and give the Data Protection Board of India a full report within 72 hours.

You can withdraw consent as easily as you gave it:

• Delete a living photo from its page; its files are removed at once.
• Disconnect Google Drive in Settings → Google Drive.
• Ask to delete your whole account in Settings → Your data.
• Turn analytics off in “Cookie settings” at the bottom of any page.
• Clear your browser's storage for this site (see above).

Withdrawing doesn't undo what was lawfully done before, and we keep only what the law requires (payment records, and copies of content we took down).

You can download a copy of your account information yourself from Settings → Your data, and correct your details there. You can also ask for a summary of your information and who we shared it with, to correct or delete it, to withdraw consent, or to nominate someone to act for you if you die or can't act. Email the contact above or use the contact page; we may need to confirm it's you.

We acknowledge requests and complaints within 24 hours. Complaints are resolved within 7 days; requests about your data are completed within 30 days, usually much sooner. If you're unhappy with our answer, you can complain to the Data Protection Board of India.

If this policy changes in a way that matters, we'll tell account holders before it applies. We also remind account holders of our rules at least once every three months, and keep a record of which version each person accepted.