Hi3D Scan Privacy Policy

Last updated: August 17, 2026

Oceano HK Holding Limited ("we," "us," or "Licensor") values your privacy. This Privacy Policy explains how we collect, use, disclose, transfer, and store personal information when you use the Hi3D Scan mobile application ("Application") and related websites, APIs, and cloud services ("Services").

Please read this Policy before using the Services. By registering, logging in, or using the Services, you acknowledge that you have read and understood this Policy. If you do not agree, please do not use the Services.

1. Information We Collect

"Personal information" means information relating to an identified or identifiable natural person. Depending on how you use the Services, we may collect:

1.1 Information You Provide

1.2 Information Collected Automatically

1.3 Device Permissions

The Application may request the following permissions. You can manage them in system settings; denying some permissions may disable related features.

The Application does not request microphone permission for in-app recording. A video you voluntarily select from your library may already contain an audio track, which is uploaded as part of that selected video.

We will not deny basic access solely because you refuse non-essential permissions, but core features such as capture, upload, and reconstruction require the relevant permissions.

2. How We Use Personal Information

We use personal information to:

1. Provide core Services: registration, login, upload, 3D generation, asset storage, preview, and sharing;
2. Security: authentication, device identification, abuse prevention, system protection;
3. Improve the product: analytics, feature optimization, algorithm improvement (often in aggregated or de-identified form);
4. Customer support: respond to inquiries and incidents;
5. Communications: verification codes, reconstruction notifications, service and policy updates (some service-related notices may not be opt-outable);
6. Legal compliance: respond to lawful requests from authorities.

3. Sharing, Processing, and Disclosure

3.1 Sharing

We do not sell your personal information. We may share necessary information when:

1. You give explicit consent;

2. Service providers process data on our behalf, including:

   • Volcengine (ByteDance) Object Storage (TOS) for videos, capture-pose and reconstruction-support sidecars, and model files;
   • Cloud computing and AI inference providers;
   • Email providers for verification codes and service notifications;
   • EngageLab AppPush for push registration, delivery, and notification performance measurement. It may process push/registration tokens, provider registration IDs, notification permission status, session information, device/app/network information, and notification receipt/open events;
   • Google Firebase Analytics for app interactions, identifiers, device/app information, and coarse location used for analytics;
   • Apple Sign in with Apple and Google Sign-In for authentication when you select those methods.

   We require processors to follow this Policy and implement appropriate safeguards.

3. Required by law, litigation, or government request;

4. Necessary to protect life, property, or legal rights of you, us, or others.

3.2 Public Disclosure

We do not publicly disclose your personal information unless you consent or law requires it. Your private videos and generated models are not placed in the public Showcase by default. If you choose to create or use a public sharing link, information you deliberately share through that link may be accessible to recipients.

3.3 Third-Party Links

The Application may link to third-party sites or services with their own privacy practices. We are not responsible for their handling of your data.

4. Storage and Cross-Border Transfer

4.1 Location

Your information is stored on servers operated by us and our processors. Depending on environment configuration, data may be stored in mainland China and/or overseas regions such as Singapore.

4.2 Retention

We retain personal information only as long as necessary for the purposes described here, unless law requires longer retention. Generally:

• Account data: while you use the Services and for a reasonable period after deletion (except legally required backups);
• Videos, capture-pose and reconstruction-support sidecars, and 3D models: while you use the related asset features, or until you delete them. Local sidecars that have not completed upload are kept in temporary cache and deleted when you exit capture, retake, complete the related task submission, or reach the stale-cleanup threshold;
• Analytics and operational logs: generally no longer than 14 months, unless a shorter period is configured or law requires otherwise;
• Push notification records: delivery and interaction records processed by EngageLab are generally deleted approximately 30 days after a notification is sent; active push tokens may be retained while needed to provide notifications or until they are invalidated or deleted;
• Account deletion: associated account data is deleted or de-identified after a valid deletion request, except data that must be retained for security, fraud prevention, dispute resolution, or legal compliance. Backup copies are isolated and removed through regular backup cycles.

4.3 Cross-Border Transfer

If personal information is transferred outside your jurisdiction, we will take measures required by applicable law (such as security assessment, standard contractual clauses, or separate consent) and ensure recipients provide protection comparable to this Policy.

5. Security

We use reasonable safeguards, including encryption in transit (HTTPS/TLS), access controls, security monitoring, and staff training. No method of transmission or storage is 100% secure. Please protect your account credentials.

6. Your Rights

Depending on applicable law, you may have the right to:

1. Access and obtain a copy of your personal information;
2. Correct or complete inaccurate information;
3. Delete your personal information (via in-app account deletion or by contacting us);
4. Withdraw consent (without affecting prior processing based on consent);
5. Delete your account;
6. Object to certain processing where applicable.

Contact us using the details below. We may verify your identity before responding. We will reply within the timeframe required by law (generally within 15 business days).

7. Children

The Services are intended primarily for users 18 years of age or older. If you are under 18, use the Services only with guardian consent. If we learn we collected a minor's data without consent, we will delete it promptly.

8. Cookies (Web)

If you access our Services via the web, we may use cookies or similar technologies for operation, analytics, and experience improvement. You can manage cookies in your browser; disabling them may affect some features.

9. Changes to This Policy

We may update this Policy from time to time. For material changes, we will notify you via in-app notice or website announcement. Continued use after an update means you accept the revised Policy.

10. Contact Us

Questions, complaints, or requests regarding this Policy:

• Email: hi3dscan_reply@hi3d.ai
• Licensor: Oceano HK Holding Limited
• Application: Hi3D Scan

Appendix: Third-Party Services (Summary)

This list may change as the product evolves.

Copyright © 2026 Oceano HK Holding Limited. All rights reserved.