Privacy Policy

Last updated: July 28, 2026. The controller of your personal data is Nakamae Yusuke, 178-201 Bentencho, Shinjuku-ku, Tokyo, Japan — full details on the Legal page. For anything in this policy, including the requests described in section 7, write to support@xibit360.art.

1. What we collect

If you have an account: your email address, display name, and the optional username, bio, avatar and social links you add; the works you upload and their titles, captions and settings; your galleries; and a record of any upgrade you buy.

If you visit someone's gallery: a count that a visit happened, any hearts you leave, and the name and message you type into a guestbook if you choose to. We do not ask visitors to sign in and we do not build profiles of them.

Automatically: our hosting and CDN providers process technical request data, including IP addresses, to serve the site and protect it from abuse.

Analytics: we use Google Analytics to understand how the service is used — which pages and galleries are opened, how long a 3D room takes to load and whether it loaded at all, which works in a gallery are opened and for how long, and which buttons are used. This is measured per visit, not per person: we do not give Google your name, email address or account ID, we do not use Google Analytics for advertising, and advertising features and data sharing are turned off. In the UK, the EEA and Switzerland, analytics storage is switched off by default, so no analytics cookie is set unless you allow it.

We do not use advertising trackers, and we do not sell or share this data for advertising.

2. Why we use it, and on what basis

To run the service: signing you in, storing and serving your works, rendering your public pages, and showing artists how many people visited (performance of our contract with you). To keep the service secure and lawful, and to act on reports of infringing or illegal content (our legitimate interests, and our legal obligations). To take payment for upgrades (performance of contract). Where we ask for consent — such as reading a caption aloud — you can withdraw it at any time.

If you opt in — when you create your account, or later in your account settings — we send occasional product news and tips to your email address. This is based on your consent; you can withdraw it at any time by turning it off in your account settings, or with the unsubscribe link in any such email. Opting out does not affect the service messages we must send to run your account, such as sign-in links and password resets.

We do not sell your data, we do not use it for third-party advertising, and we never use your uploaded works to train AI models or provide them to third parties for AI training (see the Terms).

3. Who processes it for us

We use a small number of providers, each acting on our instructions:

  • Supabase — accounts, authentication and the database.
  • Cloudflare R2 — storage and delivery of your uploaded files.
  • Vercel — hosting of the website itself.
  • Stripe — payment processing. Stripe collects your payment details directly; we never receive or store your card number.
  • OpenAI — if a caption is read aloud, that caption text is sent to OpenAI to generate the audio. Nothing else about you is sent, and your images are never sent.
  • Google Analytics — usage measurement, as described in section 1.

4. Where your data goes

These providers operate globally, so your data may be processed outside your country, including in the United States. Where data leaves the UK or the European Economic Area we rely on the transfer mechanisms our providers offer, such as the Standard Contractual Clauses.

5. What is public

Anything in a published gallery is public: the works placed in it, its title and statement, your username, display name, bio and avatar on your artist page, and any guestbook entries left on it. Published galleries are also listed on our Explore page and can be found by search engines. Unpublished galleries and works not placed in a public gallery are not visible to others.

6. How long we keep it

Your account data and works are kept until you delete them or close your account. Deleting a work removes its files from storage and clears them from our CDN. Deleting your account removes your profile, galleries and uploaded works. Records of purchases are kept for as long as tax and accounting law requires, even after an account is closed.

7. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or provide it in a portable form. Most of this you can do yourself in the dashboard. For anything else, email us and we will respond within 30 days. If you are in the UK or EEA and you think we have got something wrong, you can also complain to your local data protection authority; in Japan, to the Personal Information Protection Commission.

8. Cookies and local storage

We use browser storage for your sign-in session, to remember which works you have already hearted, and — in guest mode — to hold works you are exhibiting locally before you have an account. These are necessary for the service to function.

Google Analytics sets its own cookie to tell one visit apart from the next. In the UK, the EEA and Switzerland it is switched off by default and no analytics cookie is set unless you allow it — we ask with a bar at the bottom of the page, and declining is one tap, exactly like accepting. Elsewhere it is on. We set no advertising cookies anywhere.

9. Children

Xibit360 is for people aged 18 and over, and we do not knowingly collect data from children. If you believe a child has created an account, please tell us and we will remove it.

10. Reporting content

To report a gallery — for copyright, harassment or illegal content — use the report page. Include enough detail for us to find the work and understand the problem. We review every report and will remove content that breaks the Terms.

Privacy Policy — Xibit360