Privacy Policy

Introduction
Identity of the Controller
The Data Collected by Sketchfab Services
Privacy Settings / Opt Out
Children Privacy Rules
Digital Will
Recipients of Your Personal Data
Where We Store Your Personal Data
Exercising Your Rights in Relation to Your Personal Data
Cookies
Management of the Cookies
Changes to this Privacy Policy

Introduction

At Sketchfab, we are extremely cautious and concerned about the privacy of our users. We are proud to work hard to ensure that our processing operations comply with all regulations applicable to protect your privacy.

It is important that you understand how we look after your Personal Data (as defined in section 3 below) and how we make sure that we meet our legal obligations to you under the applicable data protection laws (including associated guidance) (the "Data Protection Laws").

In this Policy, "user" or "you" means any person using or otherwise benefiting from the Services or otherwise submitting personal information to us via the Services.

The present document applies to the processing activity carried out by Sketchfab and Sketchfab, Inc. ("Sketchfab," "we" or "us") on your Personal Data when you use any Sketchfab service, including all associated software, and websites (collectively, the "Services").

The purpose of the present document is to describe the conditions under which your Personal Data is collected and processed by us.

BY ACCESSING OR USING THE SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTAND, AND AGREE TO BE BOUND BY THIS PRIVACY POLICY INCLUDING OUR COOKIES POLICY.

IF YOU DO NOT AGREE TO THESE TERMS, DO NOT USE THE SERVICES.

This Privacy Policy is incorporated by reference into the Sketchfab Terms of Use ("Terms of Use"), available at https://sketchfab.com/terms, to which you agree to be bound by using the Services.

Identity of the Controller

In this privacy policy, the terms "we", "our", and "us" are used to refer to:

Sketchfab, Inc
1123 Broadway, Ste 501
New York, NY 10010
UNITED STATES OF AMERICA

We are a controller of your information, which means that we are responsible for looking after it. We will use your Personal Data fairly, lawfully, in a transparent manner, and in accordance with the Data Protection Laws.

The Data collected by Sketchfab Services

By using our Services, you will transmit data to us, some of which are likely to identify you ("Personal Data"). Please find below a list of the data we are processing.

Purposes	Which type of data	Legal basis for the processing
Register as a user	Username, e-mail address IP address, logs Cookies	The processing is necessary for the performance of the contract to which the user is party.
Complete user onboarding	Name, avatar Occupation IP address, logs	The processing is necessary for the performance of the contract to which the user is party.
Complete user profile	Personal websites, social accounts Biography, skills IP address, logs Primary location	The processing is necessary for the performance of the contract to which the user is party.
Engage with other users' content (search, like, comment, curate, view, follow)	IP address, logs Search queries, likes, commenting, curation, viewing, and following activities	The processing is necessary for the performance of the contract to which the user is party.
Publish content (upload, describe, categorize, tag)	IP address, logs	The processing is necessary for the performance of the contract to which the user is party.
Download content for free or for a price	First name, last name, postal address PayPal e-mail address IP address, logs	The processing is necessary for the performance of the contract to which the user is party.
Become a seller on Sketchfab Store	First name, last name, e-mail address VAT number IP address, logs Country of business Other marketplaces profile links	The processing is necessary for the performance of the contract to which the user is party.
Contact support	First name, last name, e-mail address, username PayPal e-mail address IP address, logs User agent Primary location	The processing is necessary for the performance of the contract to which the user is party.
Engage on the Forum	Display name, e-mail address, username, avatar Biography IP address, logs User agent, navigation data (viewed what, for how long), comments, likes Primary location	The processing is necessary for the performance of the contract to which the user is party.
Participate in a community contest	First name, last name, username Navigation data (used to export a contact list of people potentially interested in participating)	The processing is necessary for the performance of the contract to which the user is party.
Receive rewards (contests, prints, New Year cards...)	First name, last name, username, e-mail address PayPal e-mail address Primary address	The processing is possible as the user has given consent for this purpose.
Receive notifications and community newsletters	First name, e-mail address	The processing is possible as the user has given consent for this purpose.
Publish a story on the Blog	First name, last name, username Lifestyle habits Occupation, education, skills Commenting data (spam prevention via Akismet) Primary location	The processing is necessary for the performance of the contract to which the user is party.
Upgrade user account	First name, last name, postal address PayPal e-mail address IP address, logs	The processing is possible for legitimate interests pursued by Sketchfab.
Invite and refer friends	Friend's e-mail address IP address, logs	The processing is possible as the user has given consent for this purpose.
Perform research and analysis about your use, or interest in, our services or content, or services or content offered by others	E-mail address, user ID Occupation, skills Store revenue data Location Account type, spend, categories of models purchased	The processing is possible as the user has given consent for this purpose, and for legitimate interests pursued by Sketchfab.
Develop and display content and advertising tailored to your interests on our site and others' sites	E-mail address Cookie tracking	The processing is possible as the user has given consent for this purpose.
Prospection	First name, last name, e-mail address Current position	The processing is possible for legitimate interests pursued by Sketchfab.

The mandatory or optional nature of the personal data requested from you, and the consequences if any of a failure to answer, are specified at the time of data collection with an asterisk (*).

Apart from the limited personal data described above, we do not collect and do not wish to receive any personally identifying data.

Each time you visit our website, we may also automatically collect information and Personal Data about your computer for system administration including, where available, your IP address, your operating system and browser type and navigation data, as described in the next section below.

Please see our cookies policy in sections 10 and 11 of this privacy policy for further information about what information may be automatically collected when you visit our website.

Privacy Settings / Opt Out

For every processing where your consent is the legal basis you have the right to withdraw it at any time.

If you wish to modify any of your user profile information, withdraw your consent for the processing of your personal data, or cancel your account, you may update the settings in your user profile or contact us at privacy@sketchfab.com.

Children Privacy Rules

We are particularly committed to protecting the privacy of children who access or use our online services.

We do not knowingly collect or retain personally identifiable information about persons under 13 years of age. Any person who provides their personal information to us via the Service represents that they are 13 years of age or older.

Between the age of 13 and 15 years (included) old, we will only collect personal data if your parent(s) or legal guardian has authorized us to do so.

We strongly recommend that parents regularly monitor and supervise their children's online activities.

If you have reason to believe that a child under the age of 13 has provided personal data to us, please contact us at privacy@sketchfab.com and we will make every effort to answer your queries or to delete that information from our databases.

Digital Will

Under the French Digital Republic bill, you have the right to make arrangements for the storage and communication of your personal data after your death. To exercise this right you can send us your instructions at privacy@sketchfab.com.

Recipients of Your Personal Data

We may share your information with the other members within Sketchfab but only for the purposes specified in this privacy policy.

We may disclose your personal information:

to business partners, suppliers, and sub-contractors for the performance of any contract we enter into with them or you, for example for hosting and operating the Services or providing support and maintenance services for the Services;
to analytics and search engine providers and other selected third parties that assist us in the improvement and optimization of our Website;
to our regulators, law enforcement, or fraud prevention agencies, as well as our advisors (including legal advisors and auditors), courts, and any other authorized bodies, for the purposes of investigating any actual or suspected criminal activity or other regulatory or legal matters, etc.;
in the event of a merger, acquisition, or other similar event, to a prospective buyer or otherwise of our business or assets, in which case we will disclose your personal data to such prospective buyer or otherwise of such business or assets;
if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements; or to protect the rights, property, or safety of Sketchfab, our customers, or others. This may include exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction; and
to legal advisors and otherwise in connection with legal proceedings in order to enforce or apply our rights under any contract;

We do not share your information with third parties for marketing purposes and without your consent.

Where We Store Your Personal Data

Transfers inside of the European Economic Area

All information you provide to us is stored on our secure servers, within the European Economic Area ("EEA").

Where we have given you (or where you have chosen) a password which enables you to access certain parts of our website and apps, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Unfortunately, the transmission of information via the Internet is not completely secure. Although we will do our best to protect your Personal Data, we cannot guarantee the security of your data transmitted to our website; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access, including keeping security patches up to date wherever possible, and by constantly investigating new ways to keep data secure.

Transfers outside of the European Economic Area

The data that we collect from you will be transferred to our US entity in order to be processed by our Marketing, our Community, and our Operations teams. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy. In particular, we comply with the EU-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union to the United States. We have certified to the Department of Commerce that we adhere to the Privacy Shield Principles of notice, choice, accountability for onward transfer, security, data integrity and purpose limitation, access, recourse, enforcement and liability. If there is any conflict between the terms in this privacy policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern. Sketchfab's compliance with the Privacy Shield Principles is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC). In the context of an onward transfer, Sketchfab has responsibility for the processing of personal information we receive under the Privacy Shield and subsequently transfer to a third party acting as an agent on our behalf. Sketchfab shall remain liable under the Privacy Shield Principles if this agent processes such personal information in a manner inconsistent with the Privacy Shield Principles, unless we prove that we are not responsible for the event giving rise to the alleged damage. In certain circumstances, the Privacy Shield Framework provides the right to invoke binding arbitration to resolve complaints not resolved by other means, as described in Annex I to the Privacy Shield Principles in each of the Privacy Shield Frameworks. To learn more about the Privacy Shield program, and to view our certification, please visit https://www.privacyshield.gov/.

Please note that, for the purposes listed in this Privacy Policy, we may transfer your personal data to our service providers based outside of the European Union in countries which are not considered as providing an adequate level of protection by the EU Commission.

We guarantee that we will take all necessary measures to secure these data transfers in accordance with the GDPR (through Standard Contractual Clauses or the Privacy Shield).

A copy of the European Commission approved model clauses is available here:
https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32010D0087&from=en

Exercising Your Rights in Relation to Your Personal Data

Before processing your personal data and, at the latest, at the time of collection of your personal data, we inform you of the purpose of the processing of your personal data, the recipients of this data, the retention period applied to your personal data as well as your rights in this context.

Under French law n°78-17 dated 6 January 1978 on information technology, data files and civil liberties as amended and, after 25 May 2018, under the GDPR, you have the right to access, to rectify, to restrict and, where applicable, to delete your personal data. You also hold the right to data portability.

You have the right to request access to your Personal Data	You have the right to request confirmation that your Personal Data is being processed, access to your Personal Data (through us providing a copy) and other information about how we process your Personal Data.
You have the right to ask us to rectify your Personal Data	You have the right to request that we rectify your Personal Data if it is not accurate or not complete.
You have the right to ask us to erase your Personal Data	You have the right to ask us to erase or delete your Personal Data where there is no reason for us to continue to process your Personal Data. This right would apply if we no longer need to use your Personal Data to provide the Service to you, where you withdraw your consent for us to process special categories of your Personal Data, or where you object to the way we process your Personal Data (see the section "You have the right to object..." within this table below).
You have the right to ask us to restrict or block the processing of your Personal Data	You have the right to ask us to restrict or block the processing of your Personal Data that we hold about you. This right applies where you believe the Personal Data is not accurate, you would rather we block the processing of your Personal Data rather than erase your Personal Data, and where we don't need to use your Personal Data for the purpose we collected it for but you may require it to establish, exercise or defend legal claims.
You have the right to port your Personal Data	You have the right to obtain and reuse your Personal Data from us to reuse (in a structured, commonly used, and machine readable format) for your own purposes across different services. This allows you to move Personal Data easily to another organization, or to request us to do this for you.
You have the right to object to our processing of your Personal Data	You have the right to object to our processing of your Personal Data on the basis of our legitimate business interests, unless we are able to demonstrate that, on balance, our legitimate interests override your rights or we need to continue processing your Personal Data for the establishment, exercise, or defence of legal claims. However, you also have the absolute right to object to our processing of your Personal Data for direct marketing purposes.
You have the right not to be subject to automated decisions	You have the right to object to any automated decision making, including profiling, where the decision has a legal or significant impact on you.
You have the right to withdraw your consent	You have the right to withdraw your consent to our processing of your Personal Data.

You can exercise these rights, with a proof of your identity, by simple written request sent by email to privacy@sketchfab.com.

In compliance with the Privacy Shield Principles, we commit to resolve complaints about our collection or use of your personal information. EU individuals with inquiries or complaints regarding our Privacy Shield policy should first contact us at privacy@sketchfab.com. We have further committed to cooperate with the panel established by the EU data protection authorities (DPAs) regard to unresolved Privacy Shield complaints concerning data transferred from the EU.

We will respond to any request received from you within one month from the date of the request. If your request is not sufficiently precise or does not include all elements enabling us to answer your request, Sketchfab may ask you to provide additional elements.

You also have the right to lodge a complaint with the data protection national.

In France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL):
https://www.cnil.fr/

Cookies

We use various cookies on the Website for website analysis and improvement. When you visit our Website, cookies may be placed on your computer or smartphone.

What is a cookie? A "cookie" is a small text file placed in your browsing software to facilitate your browsing through our Websites.

Different types of cookies are placed on the Website:

Internal cookies required to run the Website in the best possible manner

Name	Purpose	Duration
sb_sessionid	Uniquely identifies the session of the visitors. Allows keeping the session of the user active when logged-in.	1 year
oauth_step	Stores the current step of the OAuth login process the user is in.	3 minutes
oauth_connected_service	Indicates if the user logged in with a social services (Google, Facebook, Twitter) during the OAuth process.	3 minutes
skfb_referrer_override	Holds the actual value of the request's referrer, because it can be set incorrectly when using Google, Facebook, or Twitter login.	4 minutes
sf_show_viewer_hint	Indicates whether to show the overlaid help when the viewer starts.	6 months
sb_theatre_mode	Indicates whether the user has chosen the "Theatre" layout for model pages.	1 year
sf_show_vr_hint	Indicates whether to show the help when entering the VR mode.	1 hour
sb_banner_closed	Indicates whether the promotional banner should be displayed.	End date of campaign (never more than 3 months)
sf_volume	Holds the value that the viewer should play the volume at, for models with sound.	1 year
sb_allows_age_restricted	Indicates the user's preference for displaying restricted models.	1 year
sf_last_news_notification	Indicates which is the latest blog post update a user saw in their newsfeed.	1 year
sb_csrftoken	Protects against Cross-Site Request Forgery security attacks.	1 year
sb_model_pwd	Indicates whether a user has had access to a password-protected model.	30 seconds
sf_email_confirmed	Indicates whether the user still needs to confirm their email address.	60 seconds
sb_buy_plan_on_onboarding	Indicates whether the user chose to subscribe to a paid plan as part of their onboarding.	1 year
sf_getting_started_closed	Indicates if the "getting started" block should be closed	1 year

Audience measurement cookies

Name	Purpose	Duration
Google Analytics (_gat, _ga, _gid)	To track traffic sources and measure aggregated KPI trends across our website.	2 years by default https://policies.google.com/privacy
Mixpanel	To track event-based analytics in order to optimize conversions and user journey.	1 year https://mixpanel.com/legal/privacy-policy/
has_mixpanel_last_touch	Indicates whether the visitor has been correctly attributed to its traffic source.	24 hours
sb_shareasaleSSCID	Share-a-sale affiliate sscid cookie.	1 year https://www.shareasale.com/PrivacyPolicy.pdf
AdRoll (__adroll_fpc)	Helps us recommend users products they would be interested in.	https://www.adrollgroup.com/privacy
Facebook	To track our conversions.	https://www.facebook.com/policies/cookies/
LinkedIn	To track our conversions.	https://www.linkedin.com/legal/privacy-policy
Twitter	To track our conversions.	https://twitter.com/en/privacy
Sendinblue	Segment audiences so they receive relevant communications via email.	https://www.sendinblue.com/legal/privacypolicy/
HubSpot	Customer relationship management tools and analytics.	https://legal.hubspot.com/privacy-policy

Third party cookies improving the interactivity of the Website

Name	Purpose	Duration
Facebook	Makes it possible to share updates to Facebook.	https://www.facebook.com/policies/cookies/
Twitter	Makes it possible to share updates to Twitter.	https://twitter.com/en/privacy
Discourse	Service provider helping us to run our Forum.	https://www.discourse.org/privacy
WordPress	Service provider helping us to run our Blog.	https://wordpress.org/about/privacy/
Zendesk	Service provider helping us to run our Help Center.	https://www.zendesk.com/company/customers-partners/cookie-policy/

Changes to this Privacy Policy

We may revise this Policy from time to time. The most current version of the Policy will govern our use of your information and will always be located at https://sketchfab.com/privacy. If we make a material change to this Policy, we will notify you via the Services or via email (to the email address associated with your account).

Effective Date of this policy: September 1st, 2019