Privacy Policy
Last updated: 2026-08-02
LabGL (“we”, “us”) operates the Vi3w service (the “Service”) and handles personal data in accordance with the Personal Information Protection Act of the Republic of Korea and other applicable laws.
This policy explains what information we process, why, how long we keep it and who we share it with — written to match how the Service actually works.
The Service is used by “users”, who build AR experiences in a workspace, and by “visitors”, who open the links or QR codes those users publish. What we collect about visitors is very limited and is set out separately in §2.
1. Scope
This policy applies to the Vi3w website (www.vi3w.net), the AR viewer (ar.vi3w.net) and the related APIs.
It does not apply once you follow an external link (such as a call-to-action) that a user placed inside their AR experience.
Where a user collects information from visitors for their own campaign, that user is the controller of that information and we act as their processor.
2. Information we collect
We collect only what the Service needs. We never collect national identification numbers.
| Context | Data | How it is collected | Required? |
|---|---|---|---|
| Sign-up (email) | Email address, password (stored as a one-way hash), display name | Entered on the sign-up form | Email and password required; name optional |
| Sign-up (Google) | Google account identifier, email address, name, email-verified status | Received from Google when you sign in with Google (scopes: openid, email, profile) | Required |
| Using the Service | Last sign-in time, language preference, browser information of the signed-in device (User-Agent, up to 400 characters) | Generated automatically at sign-in and session refresh | Required |
| Workspace invitations | Email address of the invited person | Entered by the inviting user | Required |
| Paid plans | Subscription identifier, status and period | Received from our payment provider (Polar) | Required for paid use |
| Enquiries | Name, email address, company, phone number, message, consent timestamp | Entered on the enquiry form | Name and email required; others optional |
| Content you create | Uploaded 3D models and images, experience and hotspot text, and — for location-based AR — the coordinates you choose | Entered or uploaded by you | Optional |
| Visitors viewing an AR experience | Experience identifier, time of the view or click, event type (view or CTA click) | Generated when the experience runs | — |
We do not store visitors' IP addresses, cookie identifiers, browser details or referrers, and the records above cannot identify an individual. We do not use Google Analytics or any other third-party tracking or advertising analytics.
3. Why we process it
- Creating and managing accounts and workspaces, and keeping you signed in
- Providing the Service — building, storing, publishing and running AR experiences
- Managing paid subscriptions, usage limits and payment status
- Inviting and managing workspace members
- Responding to enquiries and error reports, and improving the Service
- Sending essential emails such as verification, password reset and invitations
- Preventing fraudulent sign-ups and automated abuse
- Showing you view statistics for your own campaigns
4. Camera, location and face detection
Because the Service provides augmented reality, it may request access to your device's camera, location and motion sensors. Access is always requested through your browser and you may decline. Given how sensitive this is, we set out the details here.
- Camera images — while an AR feature (marker, image, face or location tracking) runs, the camera feed is processed only inside your device's browser. We do not transmit or store camera images on our servers.
- Face detection — face AR estimates where a face is so a 3D element can be placed on screen. Face images and facial landmarks are never sent to or stored on our servers, and are not used to identify or authenticate anyone.
- When face AR starts, the program files it needs are downloaded from third-party content networks (Google Cloud Storage operated by Google LLC, and jsDelivr). Those providers may receive the visitor's IP address and browser information (see §8).
- Location (visitors) — when a location-based experience runs, your device's position is used on the device to calculate distance. It is not transmitted to or stored on our servers.
- Location (users) — if you choose “use current location” while building a location-based experience, those coordinates are saved as part of that experience and are visible to visitors who open it.
- Photo capture — if a user enables it, visitors can save the screen as an image. The image stays on the visitor's device and is not uploaded to us.
5. How long we keep it
We delete personal data without delay once its purpose has been fulfilled, except where the law requires us to keep it.
- Under Korean e-commerce law — records of contracts and withdrawal of subscription: 5 years; records of payment and supply: 5 years; records of consumer complaints and dispute resolution: 3 years
- Under the Protection of Communications Secrets Act — service access logs: 3 months
- You can request account deletion yourself from the **Account** screen after signing in. We hold the account for 7 days so you can change your mind — you can cancel the request at any point during that period — and delete it automatically once the 7 days pass. If you cannot use that screen, contact privacy@vi3w.net and we will act within 10 days of the request.
| Data | Retention period |
|---|---|
| Account details (email, name, credentials) | Until you close your account |
| Sign-in device information (User-Agent) and session records | 14 days from issue (until the session expires) |
| Workspace invitations | Expire 7 days after they are sent; acceptance history is kept for the life of the workspace |
| Enquiry form submissions | 90 days from receipt |
| Content you create or upload | Until you delete it or close your account |
| Payment and subscription records | As required by law after the subscription ends (see below) |
| AR view and click statistics | For as long as needed to show you campaign statistics (kept in aggregate form) |
6. Sharing with third parties
We do not sell or share your personal data with third parties, except:
- where you have given prior consent;
- where required by law, or where an investigative authority requests it under a procedure prescribed by law;
- within your workspace — when you invite someone or accept an invitation, your name, email address and role are visible to other members of that workspace, as the Service requires.
7. Processors we use
We engage the following processors to operate the Service. Our agreements require appropriate protection of personal data, and we will update this policy if the processors or the scope of processing change.
| Processor | Purpose | Data processed |
|---|---|---|
| Microsoft Corporation (Microsoft Azure) | Database and file storage, application hosting, transactional email | Data processed in the course of providing the Service |
| Vercel Inc. | Website hosting (www.vi3w.net) | Access logs, including IP addresses |
| Cloudflare, Inc. | Bot protection during sign-up | IP address, browser information |
| Google LLC | Google sign-in; delivery of program files required for AR | Google account identifier, email and name (at sign-in); IP address and browser information (when files are downloaded) |
| Polar Software Inc. | Payment processing and subscription management | Payment and billing details, collected directly by the provider |
| Anthropic, PBC | AI authoring assistant (only when a user runs it) | The prompt you type and the settings and text of that AR experience |
| jsDelivr (Volentio JSD Ltd.) | Delivery of program files required for AR | IP address, browser information |
The AI assistant runs only when you invoke it; if you do not use it, nothing is sent. We never store card numbers or other payment credentials.
8. Transfers outside Korea
We transfer personal data outside the Republic of Korea as set out below. You may object to these transfers, although this may prevent us from providing the Service — contact privacy@vi3w.net.
| Recipient | Country | Data | When and how | Purpose | Retention |
|---|---|---|---|---|---|
| Microsoft Corporation | United States and other Azure regions | Data processed in the course of providing the Service | Transmitted over the network as you use the Service | Cloud infrastructure | Until the processing agreement ends |
| Vercel Inc. | United States | Access logs including IP addresses | Automatically when you visit the site | Website hosting | Until the processing agreement ends |
| Cloudflare, Inc. | United States | IP address, browser information | Automatically during sign-up | Bot protection | Until the processing agreement ends |
| Google LLC | United States | Google account identifier, email, name; IP address and browser information | When you sign in with Google, or when an AR feature loads | Social sign-in; AR program files | Until the processing agreement ends |
| Polar Software Inc. | United States | Payment and billing details, subscription identifiers | When you pay | Payment and subscription management | Until the processing agreement ends |
| Anthropic, PBC | United States | Your prompt and the experience's settings and text | When you use the AI assistant | AI authoring assistant | Until the processing agreement ends |
| Volentio JSD Ltd. (jsDelivr) | United Kingdom and others | IP address, browser information | When an AR feature loads | AR program files | Until the processing agreement ends |
9. Children under 14
We do not accept sign-ups from children under the age of 14. If we learn that an account belongs to a child under 14, we delete it and the related data without delay.
Published AR experiences can be viewed by anyone. Even then, we do not collect personal data from visitors (see §2).
10. Your rights
You may exercise the following rights in relation to your personal data at any time.
- Request access to your personal data
- Request correction of inaccurate data
- Request deletion (except where we are legally required to retain it)
- Request that we stop processing your data
- Withdraw consent by closing your account
11. How to exercise your rights, and how we delete data
You can act on most of these from the **Account** screen after signing in, or contact privacy@vi3w.net. We respond within 10 days of receiving a request. A legal representative or authorised agent may act for you on presentation of written authorisation.
When a retention period ends or the purpose is fulfilled, we delete the data without delay. Electronic records are erased so they cannot be recovered; printed records are shredded or incinerated.
When you request account deletion, your account details and the content you uploaded are deleted once the 7-day grace period passes, and the share links and QR codes you published stop working. You can cancel the request from the Account screen during that period. Where content remains in a workspace shared with other members, it stays with that workspace and ownership passes to another member.
12. How we protect your data
- Passwords are stored using a one-way hash and cannot be recovered.
- Access to databases and storage containing personal data is limited to the minimum number of people.
- All traffic between you and our servers uses an encrypted connection (HTTPS).
- Sessions expire automatically, and changing your password revokes all existing sessions.
- We apply rate limiting to block automated sign-up and sign-in attempts.
- Staff who handle personal data are instructed on our security rules.
14. Content you publish is public
When you publish an AR experience we generate a unique link and QR code. Anyone with the link can open it without signing in, and can therefore see the text, 3D models and settings it contains — including the coordinates of a location-based experience.
Uploaded 3D models and images are also served from publicly reachable addresses. Please do not upload files containing personal or confidential information.
Unpublishing an experience stops the link from working.
15. Data protection officer and contact
We have designated the following person to take overall responsibility for personal data processing and to handle complaints and remedies.
- Data protection officer: 이찬형, CTO
- Privacy requests and access enquiries: privacy@vi3w.net
- General enquiries: support@vi3w.net
16. Dispute resolution
You may contact the following Korean authorities for mediation or advice about a privacy complaint.
- Personal Information Dispute Mediation Committee — +82-1833-6972 (www.kopico.go.kr)
- Privacy Infringement Report Centre, Korea Internet & Security Agency — 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office, Cyber Investigation Division — 1301 (www.spo.go.kr)
- National Police Agency, Cyber Bureau — 182 (ecrm.police.go.kr)
17. Changes to this policy
If we add to, remove from or amend this policy, we will announce it in the Service at least 7 days before it takes effect — or at least 30 days beforehand where the change materially affects your rights.
This policy applies from 2026-08-02.