Privacy Notice
For verstice.io, Verstice Toolbox and Verstice software products
Effective date:
This Privacy Notice explains how Verstice collects, uses, stores and shares personal information when you visit our website, create or use an account, use Verstice Toolbox or our plug-ins, request support or a quote, participate in a beta, or make a purchase when purchasing functionality is available.
1. Who is responsible for your personal information
The controller responsible for the processing described in this Notice is Nikita Mezhuiev, trading as VERSTICE, an Australian sole trader (ABN 33 221 700 979), based in Melbourne, Victoria 3006, Australia (“Verstice”, “we”, “us” or “our”).
Privacy and data-rights enquiries: privacy@verstice.io
General support: support@verstice.io
2. Scope and audience
This Notice applies to the Verstice website, user accounts, Verstice Toolbox, and software products including uScatter, uTiles, uTiles Pro, uBricks, uKit and uLister. Our Services are intended for adults aged 18 and over, including individual 3D artists and business users such as visual-effects and architectural-visualisation studios.
3. Personal information we collect
| Category | Examples |
|---|---|
| Account and authentication data | Name, email address, password credentials in hashed form, profile image, account identifiers, sign-in state and authentication/session information. |
| Profile and billing data | First and last name, company, address, country, postcode, VAT ID and other billing details you choose to provide. |
| Order and payment data | Order details, product/licence information, payment status, transaction identifiers and related records. When Paddle is enabled as merchant of record, payment-card details are processed by Paddle; we receive payment confirmation and order-related information rather than full card details. |
| Quote and withdrawal data | Company, country, VAT ID, contact name, work email, phone, requested products/licences, update term, notes; and, for withdrawal requests, order, date, item/service, name, email and address. |
| Support and Feedback data | Support topic, contact details, product/version, 3ds Max version, renderer, Windows version, issue description, reproduction steps, machine name, error text, order number, Feedback and any files you voluntarily attach. |
| Device and licence data | Machine identifier, machine name, operating system, installed 3ds Max versions, installed Verstice product versions and Toolbox version, used for licensing, device management, compatibility and support. |
| Technical, session and security data | IP address, user agent, session identifiers, request paths, server/request logs, error reports, stack traces and similar diagnostic data. |
| Communications and preferences | Notification settings, product-announcement choices, transactional communications and cookie/analytics consent choices. |
| Analytics and website usage | Page views and related aggregate website analytics, collected only after consent where consent is required or used by our implementation. |
| Third-party sign-in data | If you sign in with Google or Microsoft: email, name, provider account identifier and authentication tokens; Microsoft may also provide an organisation/tenant identifier (tid). |
We do not intentionally collect precise geolocation or MAC addresses. Routine operation of Verstice Toolbox is not intended to transmit your 3ds Max scenes or project files to us. Files may be transmitted if you choose to attach them to a support request or otherwise send them to us.
4. Where we get personal information
- Directly from you when you register, manage your profile, request a quote, contact support, submit Feedback, request withdrawal, or make a purchase.
- Automatically from your browser, device, Toolbox or our hosting and security infrastructure when you use the Services.
- From Google or Microsoft if you choose social/sign-in provider authentication.
- From Paddle when payment functionality is enabled and you purchase through Paddle.
5. Why we use personal information and our legal bases
| Purpose | Legal basis (EU/EEA and UK where applicable) |
|---|---|
| Create and administer your account; authenticate you; link devices and licences; provide downloads, trials and licensed features. | Performance of a contract or steps requested before entering a contract. Where relevant, our legitimate interest in providing a secure and functional service. |
| Process orders, quotations, invoices, refunds/withdrawals and related records. | Performance of a contract; legal obligations, including tax, accounting and consumer-law requirements. |
| Provide support, investigate bugs and respond to Feedback. | Performance of a contract and our legitimate interest in supporting and improving the Services. |
| Maintain security, prevent fraud and misuse, enforce licence limits, diagnose outages and protect accounts. | Our legitimate interests in security, fraud prevention, licence enforcement and service integrity; legal obligations where applicable. |
| Send transactional, service, security and account communications. | Performance of a contract and our legitimate interests in operating and securing the Services. |
| Send optional product announcements or marketing communications. | Consent where required. You can change your choices or unsubscribe at any time. |
| Measure website usage through Vercel Web Analytics. | Consent where required and in our current implementation before analytics is enabled. |
| Establish, exercise or defend legal claims and comply with lawful requests. | Legal obligations and our legitimate interests in protecting our rights and complying with law. |
We do not use your personal information for solely automated decisions that produce legal or similarly significant effects. We do not use AI features for processing user data as part of the current Services.
6. Service providers and disclosures
| Recipient / provider | Purpose | Location / context |
|---|---|---|
| Vercel | Website hosting, request logs, deployment and consent-based web analytics. | Current deployment region: Sydney, Australia; provider is US-based and may use global infrastructure/subprocessors. |
| Supabase | Managed PostgreSQL database and account/service data storage. | Sydney, Australia; provider is US-based and may use global infrastructure/subprocessors. |
| Sentry | Error monitoring and diagnostics, including IP address, user agent and stack traces. | EU region, currently Germany; provider is US-based. |
| Resend | Transactional email delivery, including recipient email and message content. | Ireland; provider may use approved subprocessors in other locations. |
| Google and Microsoft | Optional authentication/sign-in. | Providers are US-based and operate globally. |
| Paddle | Merchant of record and payment processing when purchasing is enabled. | Depending on region, relevant Paddle entity may be in the UK, US or Canada and may use global service providers. |
| Google Workspace | Support mailbox and support-request content/attachments. | Provider is US-based and operates globally. |
| Local encrypted backup | Encrypted database backup on the owner’s working machine for business continuity. | Australia. |
We may also disclose information where required by law, to protect rights or safety, in connection with a business reorganisation or transfer, or with your direction or consent. We do not sell personal information. We do not share personal information for cross-context behavioural advertising or use third-party advertising networks in the current Services.
7. International data processing and transfers
Verstice is based in Australia, so personal information may be processed in Australia even if you are located elsewhere. Our service providers may also process information in Australia, Germany, Ireland, the United States, the United Kingdom, Canada and other locations used by their approved subprocessors.
Where the EU GDPR or UK GDPR transfer rules apply to a transfer to a separate recipient outside the EEA or UK, we use or rely on an available lawful transfer mechanism as applicable, such as an adequacy decision, the European Commission Standard Contractual Clauses, the UK International Data Transfer Agreement/Addendum, or another permitted mechanism. Provider-specific safeguards may be described in the relevant provider’s data-processing terms.
8. How long we keep personal information
| Data / record | Typical retention |
|---|---|
| Account profile | Until you delete your account or request deletion, subject to retention of specific records below where needed for licences, law or claims. |
| Licence and entitlement records | For the life of the applicable licence/account and generally up to 6 years after closure or the last relevant transaction where needed to prove entitlement, prevent fraud or resolve claims. |
| Active sessions and routine IP/request logs | Generally up to 90 days, unless longer retention is reasonably necessary for a security incident, fraud investigation or legal obligation. |
| Device / machine identifiers and linkage history | While the device is linked to your account, and generally up to 12 months after unlinking or account closure, unless longer retention is needed for licence enforcement, fraud prevention or a dispute. |
| Support tickets and attachments | Generally up to 24 months after the request is resolved; longer where the material is relevant to an unresolved dispute, security issue or legal obligation. |
| Error-monitoring events | Generally up to 90 days, subject to the configured retention available in the monitoring service. |
| Unconverted quote requests | Generally up to 24 months after the last interaction. |
| Orders, invoices, tax/accounting and withdrawal records | Generally 7 years, or longer if required by applicable tax, accounting, consumer or legal obligations. |
| Marketing preferences and consent records | Until you withdraw consent or unsubscribe; we may retain a minimal suppression/consent record for up to 3 years to respect and evidence your choice. |
| Backups | Deleted data may remain in encrypted backup copies for up to 90 days before being overwritten or removed, unless a longer period is required for security or legal reasons. |
We may shorten or extend a period where reasonably necessary to comply with law, resolve disputes, enforce agreements, respond to security incidents or reflect a change in how the Services operate. We review retention periods periodically.
9. Security
We use technical and organisational measures appropriate to the nature of the Services and data we process. Current measures include encrypted connections (TLS/HTTPS and HSTS), encryption at rest where provided by our platform providers, password hashing, encrypted backups, platform-level firewall/DDoS controls, security headers, secure cookie settings and access controls. No system is completely secure, and we cannot guarantee absolute security.
10. Your privacy rights
Depending on where you live and which law applies, you may have rights to request access to, correction of, deletion of, restriction of or portability of your personal information; to object to certain processing; and to withdraw consent at any time where we rely on consent. Withdrawing consent does not affect processing already lawfully carried out before withdrawal.
For EU/EEA and UK users, you may also have the right to object to processing based on legitimate interests and to lodge a complaint with the data-protection authority in your country. For Australian users, where applicable, you may have rights of access, correction and complaint under Australian privacy law. Residents of certain US states may have additional rights, including rights to know/access, correct, delete or obtain a portable copy of personal information, and rights relating to sale, sharing or targeted advertising where applicable. We do not currently sell personal information or use it for cross-context behavioural advertising.
To exercise a privacy right, email privacy@verstice.io. We may need to verify your identity before completing a request. If you are acting through an authorised agent, we may request evidence of authority where permitted by law.
11. Account deletion
You may request deletion through privacy@verstice.io. The account interface may also provide a “Delete my account” function once enabled. Deleting an account does not require us to delete records that we must or are permitted to keep for legal, tax, security, fraud-prevention, licence-entitlement or dispute purposes.
12. Cookies and similar technologies
We use cookies, local storage and similar technologies for sign-in, security, account presentation, preferences, consent recording and—only after the required consent—website analytics. See our Cookie Notice and the “Cookie settings” control on the website for details and choices.
13. Children
The Services are intended for users aged 18 and over. We do not knowingly offer the Services to children or intentionally collect personal information from children. If you believe a child has provided personal information to us, contact privacy@verstice.io.
14. EEA and UK representatives
Because Verstice is established in Australia and intends to offer the Services to users in the EEA and the United Kingdom, local representative requirements under the EU GDPR and UK GDPR may apply. Contact details for any appointed EEA or UK representative will be published in this Notice and made available on verstice.io/legal.
15. Changes to this Notice
We may update this Notice when our products, vendors, data practices or legal obligations change. We will post the updated version with a new effective date and, where appropriate, provide additional notice of material changes.
16. Contact and complaints
Privacy and data-rights requests: privacy@verstice.io
General support: support@verstice.io
Verstice, Melbourne, Victoria 3006, Australia
If you are not satisfied with our response, you may have the right to complain to the privacy or data-protection regulator in your jurisdiction, including the Office of the Australian Information Commissioner (where applicable), an EEA supervisory authority, or the UK Information Commissioner’s Office.
Questions about this? Contact us.