Privacy Policy

Last updated: August 4, 2026

1. Who we are

The Confy3D (CONFY3D) platform is a SaaS service for creating, managing, and publishing 3D configurators in the browser. The data controller for the processing related to the operation of the service is OOBE-XR (hereinafter also the "Provider" or "we").

The client organization using CONFY3D with its own Microsoft tenant may act as an independent controller for the product content and data it uploads (models, materials, sheets). In that case, the Provider processes such data mainly as a data processor under the client's instructions, as described in the GDPR & data processing notice.

2. Scope

This notice applies to:

• users who sign in with a corporate account (Microsoft Entra ID);
• visitors who open a share link without registering;
• browsing of the public areas (landing page, documentation, industry pages).

It does not cover third-party sites or services reachable via external links (e.g. Microsoft sign-in, any partner PIM).

3. Data we collect

3.1 Registered users

• Identity and contact: first name, last name, email address, and Microsoft account identifier, provided by Entra at login.
• Application profile: association with one or more organizations (company), active company preference, tenant-internal roles.
• Content and metadata: 3D projects, configurator rules, GLB/GLTF models, materials, textures, previews, save and publish logs.
• AI Assistant (if enabled): chat messages, technical project context (model names, meshes, rules) sent to the AI engine to generate suggestions — for authenticated users only. The interface discloses that this is an AI system (AI Act art. 50) and asks you not to enter unnecessary personal data.
• Technical logs: IP address, timestamp, API request outcome, system errors (kept for security and diagnostics).

3.2 Share-link visitors

The visitor experience doesn't require login. We may record minimal technical data (IP, user-agent, 3D asset requests) in server and CDN/storage logs to serve the scene and prevent abuse. We don't ask anonymous visitors for a name, email, or profile.

3.3 Data we intentionally don't collect

• We don't sell personal data or use it for cross-site advertising profiling.
• We don't use marketing cookies or third-party analytics in the standard version of the product (except for explicit integrations agreed with the client).

4. Purposes and legal bases (summary)

Details on retention, sub-processors and rights: the GDPR & data processing page.

5. Cookies and local storage

We manage consent through a banner and a preferences panel (categories: necessary, preferences, analytics, marketing). The choice is saved in localStorage (confy3d-cookie-consent-v1) and can be changed at any time from Cookie settings (footer or bottom-left icon).

• Necessary: Microsoft Entra (token/session), protected linktree access cookie, essential application session storage.
• Preferences (with consent only): language (confy3d-locale), UI filters and similar choices on the device.
• Analytics / Marketing: not loaded in the standard build; if enabled in the future, they only start after explicit consent.
• Documentation: sidebar state in sessionStorage (guide navigation, strictly necessary for using the section).
• Workspace session: confy3d-session stores only the active company ID (no token) — necessary for authenticated multi-tenancy.
• AI Act acknowledgment: confirmation of first assistant use (confy3d-ai-act-ack-v1) — accountability storage, not marketing.

Strictly necessary cookies/storage remain active without marketing opt-in. Optional categories stay disabled until you authorize them.

6. Sharing with third parties

We only share data with providers that support the service:

• Microsoft (Entra ID, Azure: app hosting, SQL database, Blob Storage for assets);
• OpenAI (or an equivalent configured provider) for the AI Assistant — only the prompt and project context sent by the authenticated user;
• other sub-processors listed on the GDPR page, engaged under agreements compliant with GDPR art. 28.

Data is preferably hosted in the European Union (e.g. Azure Italy North), unless otherwise configured contractually.

7. Retention

• Account and content: for the duration of the contract with the client organization and according to the tenant's backup policy.
• Technical logs: limited period (typically 30–90 days, unless required by law or security incidents).
• AI Assistant data: according to the AI provider's retention and internal policy; not used for public model training if disabled at the API contract level.

8. Security

We adopt appropriate technical and organizational measures: HTTPS, token authentication, data isolation per company, API access control, backups on cloud infrastructure, security updates.

9. Minors

CONFY3D is a B2B service aimed at professionals. It is not intended for minors under 16; we don't knowingly collect data from minors.

10. Changes

We may update this policy. The date at the top indicates the last revision; for material changes we will inform tenant administrators or publish a notice in the app.

11. Contact

For privacy requests: privacy@oobexr.com
Data Protection Officer (if appointed): dpo@oobexr.com