Privacy Policy

In this Policy, unless the context requires otherwise:

• We, Us, or Our refers to Hydrilla AI Private Limited.
• Personal Information (or personal data) is any information that relates to an identified or identifiable individual.
• Data Controller is the person that alone or jointly with others determines the purposes and means of processing personal information. In India this is the data fiduciary, and in Singapore the organisation responsible. For the purposes of this Policy, Hydrilla AI is the Data Controller.
• Service Provider means any person that processes data on our behalf to provide or support the Services. For the purposes of the GDPR, Service Providers are Data Processors.
• Cookies are small files placed on your computer or device by a website, and other similar technologies described in our Cookie Policy.
• Usage Data is data collected automatically, either generated by the use of the Services or from the Service infrastructure itself, such as the duration of a page visit.
• Content means the prompts, reference images, files, briefs, and conversations you submit, and the 3D models, textures, and other outputs the Services generate for you.
• Sell means disclosing personal information to another business or third party for money or other valuable consideration.
• Website refers to Hydrilla AI, accessible from https://hydrilla.ai.

As further described below, when you use or otherwise access the Services, we collect information when you provide it directly to us and when we passively collect it from your browser or device. We collect only what we need to provide and improve the Services, keep them secure, and meet our legal obligations.

A. Registration Information. When you register or open an account, we may collect your name, email address, and sign-in details, and any profile information you choose to add, such as a username, bio, or profile picture. If you are in Europe, we process this on the basis of entering into and performing our contract with you.

B. Purchase Information. When you purchase a paid plan, we collect the plan you choose, your billing contact details, and transaction records. Card payments are handled by our payment provider, Dodo Payments, on our behalf. We do not store full card numbers on our servers. If you are in Europe, we process this on the basis of entering into and performing our contract with you.

C. Content You Provide Through Our Services.We collect and securely store the Content you submit and generate through the Services, including prompts, reference images and other files, briefs and conversations with Water Agent, and the 3D models and textures you create. This may include personal information you choose to include. If you include other people's personal information, you confirm that you are authorised to do so. Content you choose to post to the community, along with your public profile, is visible to other users.

D. Communications to Us. When you contact us, for example for support, sales enquiries, security questionnaires, or job applications, we collect the information you choose to provide, such as your contact details and the contents of your message and any attachments. Please do not send financial or sensitive data through our channels unless we specifically ask for it.

A. Usage Information. When you interact with the Services, we automatically receive and store certain information from the devices you use, such as your IP address, browser settings, device information, operating system, pages visited, features used, generation jobs and their status, credit usage, crash data, session IDs, timestamps, and approximate location derived from your IP address. When you use a plugin, the MCP server, or the REST API, we also receive the requests your tools send and the identifier of the API key used. We collect this to ensure the security and stability of the Services. If you are in Europe, we process this on the basis of our legitimate interests.

B. Email Interaction Information. When we email you, we record whether the message was delivered, opened, or clicked, so we can keep our emails relevant and our sending reputation healthy.

C. Cookies and Other Electronic Technologies. We collect some information with commonly used technologies such as tracking pixels, JavaScript, cookies, and local storage, as described in our Cookie Policy.

We receive limited information from the providers who help us run the Services, for example confirmation of a payment from our payment provider, or sign-in details from our authentication provider when you create or access an account. We do not ask for sensitive personal information, such as health or biometric data. Please do not include it in your prompts or uploads.

We use the information collected from the Services in a manner consistent with this Policy, for the following purposes.

We use your information to operate, maintain, and provide the Services in accordance with this Policy and our Terms of Service, including to create and manage your account, authenticate you in the workspace, plugins, and API, generate outputs from your inputs and store them in your workspace, process payments, trials, renewals, and credit allowances, and respond to support requests.

Where you have agreed, or the law otherwise allows, we send product news, tips, usage summaries, and offers to the email address you provided. You can opt out of these messages at any time by unsubscribing or following the instructions in them.

We use usage information to manage, develop, improve, and maintain the Services, to monitor reliability and performance, and to analyse usage trends in order to improve their accuracy, effectiveness, security, and usability. If you are in Europe, we process this on the basis of our legitimate interests, or your consent where the law requires it.

Your Content is processed to deliver the features you ask for. Some features send your inputs to AI service providers that process them on our behalf to produce a result, for example the image model that renders a reference picture before a text-to-3D generation. These providers act on our instructions. We do not use your Content to train our models, on any plan. We do not sell Content and we do not make it public unless you post it to the community. Your Content is available to your account or workspace, and to a limited number of our staff only where needed to support you, keep the Services secure, or meet a legal obligation.

We use information to protect the security and integrity of the Services, to detect, prevent, and respond to fraud, abuse, security incidents, and breaches of our Terms, to comply with legal obligations, to resolve disputes, and to enforce our agreements. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

There are certain circumstances in which we share information collected through the Services with third parties without further notice to you, as set out below. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

We share information with companies that process it on our behalf to provide authentication, payments, hosting and storage, analytics, AI processing, email, and customer support. They may use it only to provide their services to us, under written terms that require them to protect it. Our current providers are Clerk (authentication), Dodo Payments (payments), Vercel (hosting), Supabase (database), PostHog, Google Analytics, and Vercel Analytics (analytics), Customer.io (email), and Google (Gemini), OpenAI, and Anthropic (AI processing), together with the cloud GPU providers that run our generation workloads.

Personal information may be shared with authorities, courts, or other parties where the law requires it, or where we believe disclosure is necessary to protect the rights, property, or safety of our users, the public, or Hydrilla AI.

In the event of a merger, acquisition, financing, reorganisation, or sale of assets, or steps taken in anticipation of one, your personal information may be shared with our advisers and any prospective buyer and its advisers, and will be passed to the new owners of the business, subject to this Policy.

When you link to or interact directly with third-party companies or software, such as your DCC tool, game engine, or AI client, their use of your personal information is governed by their own privacy notices. We encourage you to read them.

If you work in a shared workspace, other members of that workspace can see the Content and activity within it.

We may share your information for other purposes if you direct us to do so or you consent to the sharing.

We aggregate, anonymise, or de-identify information so that it no longer relates to you individually, and we use it for lawful purposes such as research on customer interests and behaviour.

We provide your information to other users if you choose to make it public in a publicly accessible area of the Services, such as in your posts, comments, or public profile.

The Services are not directed to children. You must be at least 18 years old to use them. We do not knowingly collect personal information from anyone under 18, and we do not track, profile, or target advertising at children. If we discover that a child has provided us with personal information, we will promptly delete it. If you believe a child has given us personal information, contact us at founders@hydrilla.ai and we will delete it to the extent required by law.

We are committed to keeping your personal information safe. We protect it with technical and organisational measures appropriate to the risk, including encryption of data in transit, access controls, and limiting staff access to what is needed. Access to workspace Content requires a signed-in account, and third parties that process data for us are bound to protect it. The security page summarises how accounts, stored assets, and exports are handled.

No transmission of data over the internet is completely secure, so we cannot guarantee the security of information transmitted to us. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires. You can help by keeping your sign-in details and API keys private. If you believe you have found a security vulnerability, please email founders@hydrilla.ai.

Do Not Track ("DNT") is a privacy preference that users can set in certain web browsers. We do not currently recognise or respond to browser-initiated DNT signals, as the internet industry has not yet agreed on what DNT means or how to respond to it.

We keep personal information only for as long as we need it for the purposes in this Policy and to meet our legal obligations:

• Account information for as long as your account is open, and for 90 days after it closes, unless we must keep certain records longer by law.
• Content until you delete it or close your account. Deleted Content may remain in backups for up to 30 days before it is permanently removed.
• Billing records for as long as tax and accounting laws require.
• Logs and security records for up to 12 months, unless we need them longer to investigate an incident.

When we no longer need information, we delete it or de-identify it so it can no longer be linked to you.

We and our service providers may process personal information in countries other than the one where you live, including the United States, where our hosting and database are located, and India. Those countries may have data protection laws that are different from the laws where you live, and we endeavour to safeguard your information consistently with applicable law. When we transfer personal information out of Europe to a country without an adequacy decision, we use safeguards recognised by those laws, such as the European Commission's Standard Contractual Clauses and the UK Addendum. Transfers from India, Singapore, and the United Arab Emirates are made in line with the requirements of their laws. You can ask us for more detail about the safeguards we use.

You have certain rights regarding your personal information, subject to applicable law. These include the right to:

• Access your personal information and receive a copy of it.
• Rectify incorrect, incomplete, or inaccurate information.
• Erase your personal information, for example when it is no longer needed or has been processed unlawfully.
• Object to processing, including for direct marketing or where we rely on legitimate interests.
• Restrict processing in certain circumstances, such as while we verify its accuracy.
• Data portability: receive your personal information in a structured, commonly used, machine-readable format and transmit it to another controller.
• Withdraw consent at any time where we rely on consent. This does not affect processing before you withdrew it.
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
• Complain to your local data protection authority. We would appreciate the chance to address your concern first.

These rights may be limited in some situations, for example where we have a legal requirement to keep the data or it is needed for the performance of a contract. To exercise them, email founders@hydrilla.ai from the address on your account. You can also update your information in your account settings. We will not treat you differently for exercising your rights.

We process personal information on the following legal bases.

Under the GDPR and UK GDPR you have the rights described in Section 9. You can complain to your local data protection authority, or in the UK to the Information Commissioner's Office. International transfers are described in Section 8.

If you are a California resident, the California Consumer Privacy Act (as amended, the "CCPA") gives you the right to know what personal information we collect, use, and disclose; to delete it; to correct it; to opt out of its sale or sharing; and to limit the use of sensitive personal information. We do not sell or share personal information as those laws define the terms, we do not offer financial incentives in exchange for personal information, and we do not use sensitive personal information for purposes that give rise to a right to limit. The categories we collect are described in Section 2, used for the purposes in Section 3, and disclosed as described in Section 4. We do not currently disclose personal information to third parties for their own direct marketing purposes. You may use an authorised agent to make a request, and we will ask the agent for proof of authority. Residents of other US states with similar laws can make the same requests.

Under the Digital Personal Data Protection Act, 2023, you have the right to obtain a summary of the personal data we process and the processing activities, to have it corrected, completed, updated, or erased, to withdraw consent, to nominate another person to exercise your rights in the event of death or incapacity, and to have your grievances addressed. Our Grievance Officer is Tharak Nagaveti, Hydrilla AI Private Limited, who can be reached at founders@hydrilla.ai and will acknowledge your grievance within 48 hours and resolve it within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

Under the Personal Data Protection Act 2012, you may ask to access your personal data and to learn how it has been used or disclosed in the past year, ask us to correct it, and withdraw consent to its collection, use, or disclosure. Withdrawing consent may mean we can no longer provide parts of the Services. Our Data Protection Officer can be reached at founders@hydrilla.ai. You may also contact the Personal Data Protection Commission.

Under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, you may request access to your personal data, its transfer to another controller, its correction or erasure, and the restriction of its processing, and you may object to processing, including processing for direct marketing and decisions based solely on automated processing. You may complain to the UAE Data Office. If you are in a financial free zone with its own data protection law, such as the DIFC or ADGM, that law may apply instead.

If you live in another country with data protection laws, you have the rights those laws provide. Contact us and we will help.

Each marketing email we send contains instructions to opt out of future marketing communications, and you can also click the "unsubscribe" link in any marketing email. If you opt out, we may still send you messages you need about your account, billing, security, and changes to our terms. We use Customer.io to send our emails. It processes your email address, name, and information about how you use the Services, such as your plan, credit balance, and recent activity, so that we can send you relevant messages.

To exercise your rights, send your request to the contact in Section 13. For your privacy and security, we may ask you to confirm your identity before we act, and we may take up to 30 days to fulfil a request, or the time the applicable law requires. Our plugins run inside third-party software, and the MCP server runs inside an AI client you choose; that software, and any website we link to, is governed by its own terms and privacy policy. Your access to and use of the Services is also subject to our Terms of Service.

We may update or modify this Policy at any time. When we do, we will update the effective date at the top of this page. Where a change will have a substantial impact on you or on how we process your personal information, we will tell you in advance by email or in the Services, and ask for your consent where the law requires it. If you disagree with our revisions, you can close your account or stop using the Services. If you are in Europe, you are not required to agree to changes to this Policy, but you acknowledge that you have read and understood its terms.

If you have any questions about this Policy or our information practices, or wish to exercise your rights, contact:

Hydrilla AI Private Limited
5-40A, Ullipatteda, Muthyal Reddy Palli, S V Nagar
Tirupati, Andhra Pradesh 517502, India
Website: hydrilla.ai
Email: founders@hydrilla.ai

Data Protection Officer: founders@hydrilla.ai
Grievance Officer (India): Tharak Nagaveti, founders@hydrilla.ai