The short version
- Ylveno is infrastructure for retailers, not a consumer product. A retailer uploads 3D models of the things it sells; shoppers see those models on the retailer’s own website. We hold the retailer’s catalogue and account. We hold almost nothing about shoppers.
- The 3D viewer, AR and room planner do not track shoppers. No cookies, no advertising identifiers, no analytics scripts, no fingerprinting. The one thing our servers see is the IP address of the request, and it is used for sixty seconds to stop abuse.
- AR happens on the phone. The camera feed never leaves the device. We never receive it.
- We do not sell personal information and we do not share it with advertisers. The companies that touch your data are the ones that host our servers and files, and they are named below.
- Retailers own their content. Models, photos and product data are theirs; deleting a model deletes its files. Photos sent for AI photo-to-3D are used to make that one model and for nothing else.
Who this policy covers
Ylveno (“Ylveno”, “we”, “us”) is operated from Dhaka, Bangladesh, and provides a cloud platform through which retailers show their products in 3D and augmented reality on their own websites. This policy covers three kinds of people, and it is honest about the fact that we know very different amounts about each.
| Who you are | What we hold | Our role |
|---|---|---|
| A retailer, or someone on a retailer's team, with a Ylveno account | Your account, your catalogue, your usage of the platform | Controller of your account data; processor of the content you put in your catalogue |
| A shopper using the 3D viewer, AR or room planner on a retailer's site | Almost nothing — see the next section | Processor, acting for the retailer whose site you are on. The retailer's own privacy policy governs that site. |
| A visitor to ylveno.com | Ordinary web server logs and anything you choose to email us | Controller |
Where we act as a processor for a retailer, we process personal data only on the retailer’s instructions and under our Terms of Service. A retailer who needs a signed data processing agreement can ask for one at privacy@ylveno.com; we will provide it.
If you are a shopper on a retailer's site
You will meet Ylveno when a furniture store or another retailer has added a 3D view to a product page, a “View in AR” button, or a room planner. These are loaded from our servers into the retailer’s page. Here is exactly what each one does with information about you.
The 3D viewer
When the viewer loads, your browser asks our servers for the model file and the product’s name and dimensions. That request carries what every web request carries: your IP address, your browser’s user-agent string and the address of the page you are on. We use the IP address to count requests for sixty seconds so that one machine cannot overload the service; the counter is then discarded. The viewer sets no cookies and stores nothing in your browser. It does not know who you are, what is in your basket, or which products you looked at before.
View in AR
On a phone, “View in AR” hands the model to the AR feature built into your operating system (Scene Viewer on Android, Quick Look on iOS, or WebXR in the browser). Your camera feed is processed on your device by your device. It is never transmitted to Ylveno, and we could not receive it if we wanted to. On a computer, the button shows a QR code that opens the same product’s AR page on a phone; the code contains only the product’s identifier.
The room planner
The planner lets you arrange a retailer’s products in a room. The room you build stays in your browser while you work on it. One preference — whether you measure in centimetres or inches — is kept in your browser’s local storage so it is remembered next time; nothing about it reaches us. If you press “Share”, the layout (which products, where, and the room’s size) is stored on our servers behind a short code for ninety days so the link works for the person you send it to, and is then deleted. A shared room contains no name, email or other detail about you.
What we never receive from a retailer's site
- Your name, email address, phone number or postal address
- Your basket, orders, payment details or account on the retailer’s site
- Your camera, photos or location
- Cookies from the retailer’s site, or any cookie of our own
The retailer decides what its site collects, and its privacy policy is the one that applies to your visit. If you have a question about Ylveno’s part specifically, write to us at privacy@ylveno.com and we will answer it directly.
If you are a retailer with a Ylveno account
Your account
To open a shop on Ylveno we hold your email address, a password (stored only as a salted Argon2id hash — we cannot read it), your shop’s name, and the email addresses of any team members you invite along with their role. If Ylveno’s own staff work on your catalogue — a manager assigned to your shop, or a designer preparing a model you asked for — a record of who did what, and when, is kept against your shop.
Signing in sets one cookie, ylveno_session, which identifies your session for thirty days. It is marked HttpOnly and Secure, and is sent to our API only. Signing out deletes it.
Your catalogue
Everything you put on the platform to show your products: 3D model files and the optimised versions we make from them, product names, SKUs, prices, dimensions, categories, thumbnails, variants, the “looks” and rooms you compose, and the viewer settings you choose. This is your content. We process it to serve your viewer, AR and planner, to optimise files for the web, to generate previews, and to count what your plan allows. We do not use it to train machine-learning models, and we do not show one retailer’s catalogue to another — Ylveno is not a marketplace.
Deleting a model deletes its files from storage at the time you delete it.
Photos you send for a model to be made
When you ask for a product to be turned into 3D — by a designer, or by our AI photo-to-3D — you upload photographs of the product. Those photographs are used to make that model and for nothing else. AI generation runs on servers we operate ourselves (on Amazon Web Services, in the United States); the photographs are not sent to a third-party AI provider and are not used to train anything. Please do not include people in product photographs; if a photograph does show a person, we treat it like any other and delete it with the request.
Your plan and usage
We keep a count of your models, the storage they use, and your rooms and looks, so that we can show you where you stand against your plan and enforce its limits. Ylveno does not currently take card payments on the platform; billing for paid plans is arranged by email, and any invoicing details you give us are held for as long as tax law requires.
Support and correspondence
If you write to us, we keep the correspondence so that we can answer you and remember what was agreed. We do not add you to marketing lists; the only email you will get from Ylveno is about your account, your requests, or changes to these terms.
If you visit ylveno.com
This website sets no analytics or advertising cookies and loads no third-party tracking scripts. Our hosting provider keeps ordinary server logs — IP address, user-agent, the pages requested and when — for a short period for security and debugging. The pricing page and this page are static; nothing you do on them is recorded by us. If you email hello@ylveno.com or privacy@ylveno.com, we keep the email.
Why we use information, and the legal basis
Where the GDPR, the UK GDPR or a similar law applies, each use of personal data needs a legal basis. Ours are these.
| What we do | Legal basis |
|---|---|
| Provide the platform to retailers: accounts, catalogues, viewer, AR, planner, model production | Performance of a contract (our Terms of Service) |
| Serve the viewer, AR and planner to shoppers on a retailer's site | The retailer's instructions (we act as processor); our own legitimate interest in running the service reliably |
| Rate-limit requests by IP address for sixty seconds | Legitimate interest: keeping the service available and not paying for abuse |
| Keep shared room links working for ninety days | Legitimate interest: doing what the person who pressed “Share” asked for |
| Generate a 3D model from photographs a retailer uploads | Performance of a contract |
| Enforce plan limits and arrange billing | Performance of a contract; legal obligation (tax and accounting records) |
| Answer support requests and correspondence | Legitimate interest; performance of a contract |
| Detect, investigate and prevent security incidents | Legitimate interest; legal obligation |
| Remember a shopper's unit preference in the planner | Strictly necessary functional storage, no consent required; nothing is sent to us |
We do not make automated decisions with legal or similarly significant effects about anyone.
Where it is stored, and international transfers
Ylveno is operated from Bangladesh and its servers are in the United States, as listed above. If you are in the European Economic Area, the United Kingdom or Switzerland, your data is therefore transferred outside your region. For those transfers we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) with our sub-processors, and we will enter into the same clauses with any retailer that needs them — ask at privacy@ylveno.com. Shoppers’ data that reaches us is limited to what is described above and is not stored beyond the periods in the next section.
How long we keep it
| Data | Kept for |
|---|---|
| IP-based request counters (viewer, AR, planner) | 60 seconds, then discarded |
| Server request logs at our hosting providers | Up to 30 days |
| Shared room layouts | 90 days from sharing, then deleted |
| Shopper's unit preference (centimetres / inches) | In the shopper's own browser only; cleared when they clear site data |
| Retailer account (email, hashed password, team, roles) | For the life of the account, then deleted within 30 days of closure |
| Session cookie | 30 days, or until sign-out |
| Catalogue content (models, product data, thumbnails, looks, rooms) | Until the retailer deletes it or closes the account; files are deleted from storage when a model is deleted |
| Photographs sent for model production | Until the request is completed and the retailer deletes it, or the account is closed |
| Plan and usage counts | For the life of the account |
| Invoicing and payment records | As long as tax and accounting law requires (typically 6 years) |
| Support correspondence | 3 years after the last message |
| Backups | Database backups roll over within 30 days; deleted data leaves the last backup within that time |
How we protect it
- Every connection is encrypted with TLS: browser to viewer, viewer to API, dashboard to API, and between our own services.
- Each retailer’s data is isolated inside the database by row-level security: every query runs as the retailer it belongs to, so one shop cannot read another’s rows even through a bug in our own code.
- Files are never public. Models, photographs and thumbnails are served through signed links that expire within an hour.
- Passwords are hashed with Argon2id and never stored or logged in clear. Session cookies are HttpOnly and Secure.
- Access is limited to the people who need it to run the service, and production credentials are rotated if they are ever exposed.
- If a breach affects your data, we will tell affected retailers without undue delay and within 72 hours of becoming aware of it, with what we know and what we are doing.
No system is perfectly secure, and we will not claim ours is. If you find a vulnerability, please write to privacy@ylveno.com; we will respond within two working days and will not take action against good-faith research.
Your rights
Wherever you are, you can ask us what we hold about you, ask us to correct or delete it, and object to how we use it. Under the GDPR and UK GDPR you additionally have the rights to restrict processing, to data portability, to withdraw consent where consent is the basis, and to complain to your supervisory authority. Under the California Consumer Privacy Act you have the rights to know, to delete, to correct, and to opt out of sale or sharing — and, since we do not sell or share personal information for cross-context advertising, there is nothing to opt out of. We do not discriminate against anyone for exercising a right.
| If you are… | How to exercise your rights |
|---|---|
| A retailer | Most of it you can do yourself: edit or delete models, looks and rooms from the dashboard; change your password; remove team members. To export your catalogue or close your account, email us and we will complete it within 30 days. |
| A shopper | We cannot identify you from what reaches us, so there is usually nothing to look up. Ask the retailer whose site you used first, as they control that site; if a shared room link should be removed early, send us the link and we will delete it. |
| A visitor | Email us. We will confirm what we hold (usually only your email to us) and delete it on request. |
Write to privacy@ylveno.com. We answer within 30 days, and we may ask you to confirm you are who you say you are before acting on a request about an account.
Children
Ylveno accounts are for businesses and their staff, and you must be at least 18 to open one. A shopper of any age may see a 3D viewer on a retailer’s site, and because the viewer collects no personal information, no special treatment is needed. If you believe a child has given us personal information, tell us at privacy@ylveno.com and we will delete it.
Changes to this policy
We will change this policy when the product changes — for example if we add engagement analytics for retailers, take card payments, or add a sub-processor. For a change that affects what we collect or how we use it, we will email every retailer account at least 14 days before it takes effect and note the change at the top of this page. The effective date above always tells you which version you are reading.
Contact
Ylveno, Dhaka, Bangladesh.
Privacy questions and requests: privacy@ylveno.com
Everything else: hello@ylveno.com