Privacy Policy

Effective date: 1 November 2026 · version 2026-11-01

This policy explains what HoloAR (https://holo-ar.com), operated by Netanel Huri, Israel, collects when you run a library or visit a library page, and what we do with it.

1. Library owners

Sign-in: we receive your email address and a stable account id from Google (OpenID Connect, scope "openid email"). We store them with your library. We do not receive or store your Google password or any Google token after sign-in. A session cookie (HttpOnly, 30 days) keeps you signed in; signing out deletes it on the server.

Library data: the business name, address, description, category, language, the items (names, prices, descriptions, sizes, photos, the generated models), your plan and its status, and payment records (Paddle transaction and subscription ids, amount, currency, date). We do not store card numbers; Paddle handles payment.

Photos are sent to our 3D model provider to build the model and are processed there under their terms; we send only the photos, not your name or email. The raw model from the provider is deleted after we scale and optimise it unless we keep it for debugging a failed build.

Retention: library data is kept while the library exists, including models that went offline after a plan ended, so that subscribing again can bring them back. Deleting an item deletes its photos, model and counters at once. To delete your whole library and account, email us from the signed-in address; we delete within 14 days except purchase records, which we keep for the period required by tax law.

2. Visitors of a library page

Library and item pages are public. Opening one loads the page, the photos and the model from our server (our server log keeps the IP address, time, page and browser type for up to 30 days for security and capacity). The page reports a "view", and an "AR launch" when the AR button is pressed, to our server: these are counts per item and day, with no identifier of the visitor, shown to the library owner.

AR on the phone runs in the phone's own viewer (Apple Quick Look or Google Scene Viewer); the camera image never reaches our server.

We do not use advertising trackers or third-party analytics on these pages. A visitor's language choice is kept in the browser's local storage only.

When a page is embedded in another website, that website's own privacy policy applies to the visit there; our page inside it behaves as described above.

3. Payment

Plans are sold by Paddle.com as Merchant of Record. Paddle collects the payment details and your email for receipts, and makes the monthly charges, under its own privacy policy (https://www.paddle.com/legal/privacy). We receive the transaction and subscription ids, the plan and its status and renewal date, the amount, currency, country and the library id, which we store with your library.

4. Processors and transfers

Our processors: DigitalOcean (hosting, EU), Cloudflare (DNS, email routing), Google (sign-in), Paddle (payments), the 3D model provider (model generation; United States). Data may therefore be processed outside Israel and the EU; we choose providers that commit to standard contractual protections.

5. Your rights and contact

You can ask to see, correct, export or delete your data, and object to processing, by emailing [email protected] from your account address. We answer within 30 days. If you are in the EU/UK you also have the right to complain to your supervisory authority.

Greetings bought before October 2026 are covered by the archived privacy policy of that time (/landing/legal/versions/); the data of those greetings is kept and deleted as described there.