Privacy Policy

This Privacy Policy explains how Third Room Studio LLC (“Company,” “we,” “us,” or “our”), a Delaware limited liability company, collects, uses, and shares information about you when you use Capsules (the “Service”). Please read this policy carefully. By using the Service, you agree to the practices described here.

1. Information We Collect

1.1 Information You Provide

• Account information: name, email address, and password when you register.
• Profile information: display name, profile picture, and any optional biographical content.
• Payment information: billing details processed and stored by Stripe on our behalf. We do not store full credit card numbers.
• Content you create: text, prompts, images, and video you author or upload through the Service.
• Communications: messages you send to our support team or via feedback forms.

1.2 Information Collected Automatically

• Usage data: pages visited, features used, generation requests made, and session duration.
• Device & browser data: IP address, browser type and version, operating system, and device identifiers.
• Error & performance data: crash reports and performance metrics collected via Sentry.
• Cookies and similar technologies: see Section 5 below.

1.3 Information from Third Parties

• Google OAuth: if you sign in with Google, we receive your name, email address, and profile picture from Google.
• Stripe: we receive billing status, subscription tier, and payment event data from Stripe.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Process payments and manage subscriptions.
• Generate AI content on your behalf using your prompts.
• Send transactional emails (email verification, password reset, receipts).
• Send product updates and announcements (you may opt out at any time).
• Detect, investigate, and prevent fraudulent or unauthorized activity.
• Monitor and improve Service performance and reliability.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information to third parties. We do not use your content to train AI models without your explicit consent.

3. How We Share Your Information

We share your information only in the following circumstances:

• Service providers: We share data with trusted vendors who process it on our behalf, including Replicate (AI generation), Stripe (payments), DigitalOcean / Cloudflare (storage), and Sentry (error monitoring). These providers are contractually required to protect your data.
• Collaboration features: Content shared within a workspace is visible to other members of that workspace as you configure.
• Public capsules: If you choose to publish a capsule publicly, its content is accessible to anyone with the link.
• Legal requirements: We may disclose information if required by law, regulation, legal process, or governmental request.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you in advance of any such transfer.

4. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymize your personal data within 90 days, except where we are required to retain it by law (for example, financial records) or for legitimate business purposes such as fraud prevention.

Generated media files stored in cloud storage are retained for the duration of your subscription and for a grace period of 30 days following account deletion.

5. Cookies & Tracking Technologies

We use the following types of cookies and similar technologies:

You can control cookies through your browser settings. Disabling essential cookies may prevent you from using core features of the Service.

6. Data Security

We implement industry-standard security measures including TLS encryption in transit, encrypted storage at rest, and access controls to protect your personal information. However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security and encourage you to use a strong, unique password and enable any available account security features.

7. Your Rights — GDPR (EEA & UK Users)

If you are located in the European Economic Area (EEA) or United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) or UK GDPR:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data, subject to legal retention requirements.
• Right to Restriction: Request that we limit how we process your data in certain circumstances.
• Right to Data Portability: Receive your personal data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing.
• Rights Related to Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

Our legal basis for processing personal data includes contract performance (providing the Service), legitimate interests (security, fraud prevention), consent (marketing communications), and legal obligation. To exercise your rights, contact us at [email protected]. We will respond within 30 days.

8. Your Rights — CCPA (California Residents)

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have the right to:

• Know what personal information is collected, used, disclosed, or sold.
• Delete personal information we have collected (subject to certain exceptions).
• Correct inaccurate personal information.
• Opt-out of sale or sharing of personal information. We do not sell personal information as defined under CCPA.
• Non-discrimination: We will not discriminate against you for exercising your privacy rights.

To submit a verifiable consumer request, contact [email protected]. We will verify your identity before processing requests. You may designate an authorized agent to submit requests on your behalf.

9. International Data Transfers

Third Room Studio LLC is based in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries. We rely on appropriate safeguards (such as Standard Contractual Clauses for EEA transfers) to ensure your data is protected in accordance with applicable law.

10. Children's Privacy

The Service is not directed to children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will take steps to delete such information promptly. If you believe a child has submitted information to us, please contact [email protected].

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice in the Service or by email at least 30 days before the changes take effect. The date at the top of this page indicates when the policy was last updated. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our Privacy Team: