Privacy Policy

At Free3D.io ("we", "us", or "our"), we respect your privacy and are committed to protecting it through our compliance with this policy. This Privacy Policy describes the types of information we may collect from you or that you may provide when you visit the website Free3D.io and our practices for collecting, using, maintaining, protecting, and disclosing that information.

1. Information We Collect

We collect several types of information from and about users of our Website, including:

• Personal Data: Information by which you may be personally identified, such as name, postal address, e-mail address, telephone number, if you choose to provide it (e.g., via contact forms).
• Usage Data: Information about your internet connection, the equipment you use to access our Website, usage details, IP addresses, and information collected through cookies and other tracking technologies.
• AI / Programmatic Access Data: When the Website is accessed by an automated agent (LLM, AI assistant, web crawler, scraper, scripted client, etc.) we additionally record the request timestamp, the requested resource URL, the resolved client IP address (from CF-Connecting-IP or X-Forwarded-For), the User-Agent string, the Cloudflare Ray ID, the payment method attempted (X-API-Key, PAYMENT-SIGNATURE, X-Payment, X-Access-Token), and the verification outcome (OK / FAIL with the granular error code).
• Payment-related Identifiers: When a payment is submitted we additionally store, for replay-attack prevention, billing reconciliation and statutory accounting: blockchain wallet addresses that appear in the EIP-3009 authorization.from field, transaction hashes and the network they belong to, EIP-3009 nonces, issued one-time access tokens, and hashed API keys for active subscriptions. Wallet addresses are pseudonymous on-chain identifiers; we treat them as personal data only where applicable law (e.g., GDPR Recital 26 / 30) requires it.

2. How We Collect Information

We collect this information:

• Directly from you when you provide it to us.
• Automatically as you navigate through the site. Information collected automatically may include usage details, IP addresses, and information collected through cookies, web beacons, and other tracking technologies.

3. How We Use Your Information

We use information that we collect about you or that you provide to us, including any personal information:

• To present our Website and its contents to you.
• To provide you with information, products, or services that you request from us.
• To improve our Website, user experience, and model offerings.
• To fulfill any other purpose for which you provide it.
• To notify you about changes to our Website or any products or services we offer or provide though it.

4. Disclosure of Your Information

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction. We do not sell, trade, or otherwise transfer to outside parties your Personally Identifiable Information unless we provide users with advance notice. This does not include website hosting partners and other parties who assist us in operating our website, conducting our business, or serving our users, so long as those parties agree to keep this information confidential.

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to track the activity on our Service and hold certain information. Cookies are files with small amounts of data which may include an anonymous unique identifier. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent.

6. Data Security

We have implemented measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure. However, the transmission of information via the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted to our Website.

7. Links to Other Websites

Our Service may contain links to other sites that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

8. Changes to Our Privacy Policy

It is our policy to post any changes we make to our privacy policy on this page. If we make material changes to how we treat our users' personal information, we will notify you through a notice on the Website home page. You are responsible for ensuring we have an up-to-date active and deliverable email address for you, and for periodically visiting our Website and this privacy policy to check for any changes.

9. AI Agent / Programmatic Access — Lawful Basis & Retention

Why we process this data. Access by AI agents and other automated clients is paid (see Terms of Use §8). Processing the data listed in §1 above is necessary to (i) verify that a payment is genuine and unique, (ii) prevent replay attacks and fraud, (iii) bill subscription holders, (iv) enforce rate limits against abusive crawlers, and (v) comply with our statutory record-keeping obligations.

Lawful basis (GDPR Art. 6).

• Art. 6(1)(b) — performance of a contract: applies once an AI agent or its operator has accepted our Terms by sending a payment header.
• Art. 6(1)(f) — legitimate interest: applies to the logging of every 4xx event from an automated agent (including pre-payment 402 responses), where our interest is anti-fraud, anti-abuse, and the operation of a paid API at scale. This interest does not override the rights of natural persons browsing the site through a normal browser.
• Art. 6(1)(c) — legal obligation: for accounting records of received payments.

Retention. The application logs (logs/x402.log, logs/x402_conversions.log, logs/eip3009_authorizations.log) are retained for up to 12 months from the event date and then rotated. Payment-related identifiers (used tx_hash, EIP-3009 nonces, and access tokens) are retained indefinitely in the replay-protection database — purging them would re-enable replay attacks. Hashed API keys are retained for the lifetime of the subscription plus statutory accounting periods. We never store unhashed API keys.

Recipients. AI-access data is processed by us and by Cloudflare (CDN / WAF / bot management) acting as a processor. We do not sell or rent this data. We may disclose payment-related records to law-enforcement, tax, or regulatory authorities where required by applicable law.

Your rights. If you operate an AI agent that has interacted with our paywall and wish to exercise rights of access, rectification, or erasure under the GDPR, UK GDPR, CCPA, or comparable laws, contact free3dio@pm.me. Please include the wallet address, API key fingerprint, or representative Cloudflare Ray ID so we can identify the relevant records. We cannot erase on-chain transactions; we can only remove your data from our internal logs and indices, subject to the replay-protection exception described above.

Automated decisions. The paywall makes deterministic technical decisions (allow / deny, rate limit) based on payment status and request rate. These are necessary for entering into and performing the contract within the meaning of GDPR Art. 22(2)(a) and do not produce legal or similarly significant effects on natural persons, who can browse the site freely without payment.

Last updated: 2026-05-08