This document reflects the current application. Company details and operational policies marked below still need confirmation before production publication.
Overview
AR-Mango provides tools for creating, managing, publishing, and analyzing 3D models, AR experiences, digital assets, QR experiences, projects, and business workspaces. This policy explains how information is handled when you use these tools or visit published experiences.
For personal account and service operations, the responsible business is Awaiting operator confirmation. When a business customer uploads content or runs an experience, that organization also determines how its content and campaign information is used. Contact that organization about its own content or privacy practices.
This notice describes the current implementation. The deployment details below must be completed before this draft becomes the production notice.
Information We Collect
Information you provide. Account name, email address, organization name, profile settings, website and branding preferences; project names and descriptions; uploaded images, videos, generation prompts, 3D files, and world scene documents; model settings; AR configuration; QR names, destinations, and artwork; and privacy or support communications you choose to send.
Passwords are stored as one-way hashes, not as readable passwords. Authentication also uses session records, hashed remember-me tokens, hashed reset or verification tokens, and security events. API keys are stored as hashes.
Information from use. With analytics permission, published experiences record the experience identifier, event type, timestamp, and a hash derived from a session identifier. Dynamic QR redirects can record the QR identifier, timestamp, the same kind of session hash, and a broad mobile/desktop category derived from the browser’s user-agent header.
Security rate limits use hashes derived from IP addresses and, for some account actions, email addresses. The server receives ordinary network request information. Deployment-level access and error logs may contain request or error details; the hosting operator must confirm its logging settings. The application does not currently derive location or store detailed browser, operating-system, referrer, or campaign-parameter analytics.
The database supports plan, subscription status, and provider customer/subscription identifiers. Paid checkout is not enabled. AR-Mango does not collect full payment-card numbers or CVVs through the current application.
Account protection also records broad browser and operating-system labels, recognized/trusted device records, and session activity and expiry times. Device recognition uses a first-party cookie with a maximum 30-day lifetime rather than fingerprinting. Authenticator secrets and pending security-email contents are encrypted; recovery codes and device/session tokens are stored as hashes. Security emails use a configured SMTP provider. Queued message contents are removed after delivery or terminal failure, while operational delivery metadata is retained under the operator’s retention policy. The application does not infer your location.
How We Use Information
- Create accounts, authenticate users, and maintain workspaces and permissions.
- Store, display, edit, optimize, and where configured generate assets at your request.
- Publish selected experiences, resolve QR destinations, and provide consent-based engagement measurements.
- Manage profile settings and available plan metadata; respond to support and privacy requests.
- Detect abuse, apply rate limits, investigate failures, and protect accounts.
- Meet applicable legal obligations and resolve disputes where relevant.
Where a lawful basis is required, the operator must document which basis applies to each purpose. Providing an agreed service, consent for optional measurement, applicable legal obligations, and assessed legitimate interests in security may be relevant; they are not interchangeable. The operator’s markets and final legal-basis assessment are pending: Awaiting operator confirmation.
Your Files, 3D Models and AR Content
You may upload product photographs, reference images, self-contained GLB or embedded GLTF files, OBJ or STL models, and logos or brand artwork. Embedded textures, model settings, and AR configurations can be processed with the relevant asset.
AR-Mango processes assets to provide the features you request. A configured external generation provider may receive an uploaded image to generate a model. Files are not guaranteed to remain solely on AR-Mango infrastructure.
Optimization uses a server-side processing worker and preserves the original file. Generation uses a configurable external service; its production provider is Awaiting operator confirmation. That provider’s processing location, retention, and any model-training use must be confirmed before enabling generation. This draft makes no promise about an unidentified provider’s practices.
Published experiences expose their presentation and model to anyone able to access the public link. Recipients can retain copies. Treat publishing as disclosure to that audience. Private uploads use authorized file access; a public experience’s model is intentionally accessible through its published viewer.
The local design preview stores workspace records in this browser and uploaded files in IndexedDB. Clearing site data can remove those local records. Local drafts do not publish themselves to the server.
Data Storage
Authenticated service records are stored in a MySQL database. Uploaded files are stored on the configured application server. Local preview records and files are stored in your browser.
Hosting provider: Awaiting operator confirmation
Hosting region: Awaiting operator confirmation
Hosting, backup, and log-access arrangements must be confirmed by the operator. The application does not itself guarantee a particular storage country or backup schedule.
Security
The implementation uses password hashing and verification, organization-scoped access checks, role-based permissions, CSRF checks for account mutations, session rotation, expiring reset tokens, hashed API and remember-me tokens, and rate limiting. Session cookies use HttpOnly and SameSite settings; the Secure flag depends on an HTTPS production configuration.
Production HTTPS, infrastructure access restrictions, backups, patching, and operational monitoring remain the operator’s responsibility. No internet-based service can guarantee absolute security.
Do not send passwords, card details, identity documents, or unnecessary sensitive material through the privacy request form.
Analytics
Optional AR events include page views, successful model loads, a first model interaction, AR clicks and successful AR starts, and CTA clicks. Dynamic QR redirects can count a scan when a valid analytics preference already exists. A redirect without that permission continues to its destination without recording a scan.
Workspace analytics display aggregate counts and trends, rather than individual visitor identities. The current event records use a session hash and do not use an invasive fingerprinting script, cross-site advertising ID, or precise location.
The workspace owner can disable experience analytics independently. Your refusal also prevents collection. Withdrawal stops subsequent optional events; it does not automatically erase previously recorded data. Use a privacy request if you want to ask about that data.
For branded public pages, consent-gated measurements can include page views, video starts, video completions, and action-link clicks. The event record contains the page identifier, organization identifier, event type, a hashed session identifier, and event time. Camera previews, image pixel checks, and QR decoding run in your browser; capture files are uploaded only when you choose to save accepted inputs.
Data Retention
Different records may need different retention rules, depending on account status, service delivery, security, billing obligations, disputes, legal requirements, and backup cycles. There is no adopted general deletion or backup schedule in the current deployment configuration: Awaiting operator confirmation.
Some technical expiry periods are implemented: remembered sign-in expires after 30 days, inactive authenticated sessions expire after 8 hours, and consent preferences expire after 180 days or when the configured consent version changes. Expiry of a credential is not a promise that every related database or log record has been erased.
Deleting a personal account must be reviewed separately from deleting shared organization content. Organization ownership, other members, subscription obligations, retention requirements, and backups can affect the outcome. Submission of a deletion request does not immediately erase an account or shared workspace.
Your Privacy Rights
Depending on your location and applicable law, you may be able to request access, correction, deletion, restriction, portability, or object to particular processing. Where processing relies on consent, you can withdraw it. Rights, exceptions, and response requirements vary by jurisdiction.
Submit a privacy request or use the privacy contact below. The request form records your submission for review; it does not disclose account information or automatically execute deletion. Identity and authority may need to be verified before a request is fulfilled. Knowing an email address alone is not proof of identity.
Signed-in users can request account deletion in Settings → Account & privacy. An owner’s request is reviewed for ownership transfer and shared-data obligations. You may also be able to complain to the relevant data-protection authority in your jurisdiction.
International Data Transfers
Depending on deployment and requested processing, infrastructure or providers may process data outside your own country. The actual locations must be identified before production use.
Transfer arrangements and safeguards: Awaiting operator confirmation. Where applicable law requires safeguards, the operator must establish them before the relevant transfer. No specific adequacy determination or contractual safeguard is claimed by this draft.
Children’s Privacy
The product is designed for business and creative workspaces. The operator has not yet supplied its adopted minimum age or market-specific child-privacy rules: Awaiting operator confirmation.
If you believe a child’s information has been provided inappropriately, use the privacy request form or configured privacy contact. Such reports require review under the rules applicable to that deployment. This notice does not invent a universal age threshold.
Third-Party Services
The current architecture uses configured hosting, database/file infrastructure, an email transport for account messages, and an optional external image-to-3D generation provider. These are the deployment entries that need confirmation:
- Hosting: Awaiting operator confirmation
- Email delivery: Awaiting operator confirmation
- Generation processing: Awaiting operator confirmation
No external payment checkout, advertising service, or third-party analytics SDK is enabled by the current code. Interface fonts and libraries are served locally. Some existing sample product thumbnails are bundled image files.
Links, QR destinations, and device AR viewers may open services outside AR-Mango. For example, a compatible Android device can open Google’s Scene Viewer with the public model URL. The destination service handles its own requests under its own terms and privacy practices.
Changes to This Policy
This policy may change when features, providers, privacy practices, or applicable requirements change. The “Last updated” date identifies the content revision.
The operator should provide any required notice of material changes before they take effect. A new version of consent purposes can require a new choice; that choice must precede optional measurement. A date change alone does not establish that users were notified.
Contact Us
For questions or requests, use the privacy request form. Requests are reviewed before account information is released or changed.
- Privacy contact
- support@ar-mango.com
- Company
- Awaiting operator confirmation
- Business address
- Awaiting operator confirmation