Draft — pending final wording.
The English text is the binding version.
Operator: Custom 3D Model, a DBA of TOPPROPERTY LLC, Florida, USA. Contact: support@c3dm.cc.
Name, email address, password (stored hashed), preferred language, two-factor secret (if enabled), workspace membership and role, actions in the account (audit log: who changed what and when), API keys (stored as fingerprints), webhook endpoints you configure. Purpose: to run your account, secure it and show you the history of changes. Legal basis: performance of a contract.
When a code is scanned or a page is opened: time, code, channel (QR / NFC / SMS / email), IP address, user-agent (device type, OS, browser), country and city derived from the IP, referrer, and a random attribution session id. The full IP address is kept for 30 days to detect robots and derive the city, then truncated. No cookies are set by the redirect core. Pages hosted on c3dm.cc set no tracking cookies; embedded videos load only after you press play (youtube-nocookie.com).
If you fill in a form on a hosted page, what you type (name, phone, email, message, chosen time) is stored and shown to the page owner, who is the controller of that data. Drafts you do not send are kept for two days as "abandoned" and then only as a record for the owner.
Purpose: to make the redirect work, to show owners how many people visited and from where, and to deliver what visitors sent. Legal basis: legitimate interest of the page owner (statistics) and performance of the owner's request (forms).
Senders using the API pass only their own references (campaign, recipient, touch) — no names, addresses or phone numbers. We cannot identify a recipient; the sender can, in their own systems.
Data is stored on servers of our hosting provider (Hostinger). Emails are sent through our mail server. We do not sell data and share it only with providers needed to run the Service (hosting, email) and when required by law. Webhooks you configure send data to endpoints you chose; you are responsible for them.
Account data — while the account exists; audit log — 2 years; scans — full IP 30 days, truncated record 24 months, daily summaries indefinitely; submissions — until the owner deletes the page or the account; backups — 30 days.
Account holders can view and change their data in the account and ask us to delete the account. Visitors may ask the page owner, or us, to delete what they sent. Residents of regions with data-protection laws (GDPR, CCPA/CPRA) may exercise access, correction, deletion and objection rights by writing to support@c3dm.cc.
HTTPS everywhere, hashed passwords, two-factor authentication for administrators, API keys stored as fingerprints, signed webhooks, nightly encrypted-at-rest backups kept off the web root. No system is perfectly secure; we will notify affected users of a breach as required by law.
The Service is not directed at children under 16 and we do not knowingly collect their data.
We may update this policy; material changes are announced in the account. Date of this version: 2026-10-31.
Terms of Service · Privacy Policy · Sign in