Privacy

Who is responsible

CHUMA is a project developed by Olga and Elena. This notice describes the current closed prototype, not a public client service. Questions about processing and deletion of data: chumastudiobyelena@gmail.com.

What happens when you use the site

The public scene controls run in your browser. The private workspace accepts images, material references and descriptions, dimensions and file names. It stores these together with job identifiers, timestamps, processing status, errors and exported 3D files in Cloudflare R2. New uploads also record the version and time of the upload acknowledgement. There are no individual client accounts, payments, advertising trackers or audience analytics in this prototype.

If you type a public scene command, the text is sent to a Cloudflare server function for validation. In Rules Mode, it is not sent to an AI provider. The optional AI Active command mode sends the text to OpenAI for interpretation. Disabling response storage is not a guarantee that the provider keeps no security logs. This text command feature is separate from image reconstruction.

When AI mode is active, Cloudflare Turnstile checks that the request comes from a person and processes security signals for that purpose.

Cloudflare hosts and protects the site. It may process technical request data such as an IP address, browser and device information, requested pages, timestamps and security signals to deliver and protect the service.

Private uploads and access

Project conversations store submitted text, message identifiers and timestamps in the same private cloud storage. Everyone with the workspace password can read these messages. Save note stores text without calling AI or changing a scene.

When the internal test is enabled, Analyze with Flash sends the selected project's uploaded images, dimensions, material descriptions and saved messages through Cloudflare to OpenRouter and the pinned Together provider running GLM 5.3 Flash. This requires a separate confirmation of permission. Public material reference links are included as text, not inspected as images. The AI reply, model and provider identifiers, reported usage and confirmation time are saved in private storage. This produces analysis only, not a new 3D scene.

The analysis request restricts provider routing to endpoints declared eligible for zero data retention and rejects data collection routes. These controls do not verify the OpenRouter account owner's optional request logging settings or guarantee that no technical or security records exist. Processing may occur outside the EU. Read OpenRouter's data collection information and Together's privacy policy. Do not submit personal or confidential data in this internal test.

The legacy worker downloads uploaded files to Olga's Mac and runs Blender locally to export a saved bathroom scene. Saving a new draft project does not start that worker. Uploaded images, measurements and materials do not automatically create new geometry.

Build test scene creates a separate technical job with fixed, validated geometry commands based on saved dimensions. It starts Blender with an empty scene on Olga's Mac and returns a new GLB, Blender file, preview and build report to private storage. Images, notes and material references are not interpreted in this mode, and no AI provider is called. The original image project and approved scene are not overwritten.

Access uses a shared password and an essential signed session cookie lasting up to 12 hours. Everyone with access can see the shared job list and download available results. There is no separation between individual clients. Uploaded files are not published on the public site by this workflow.

Improve with AI is a separate, explicitly approved test. Deep Agents runs on Olga's Mac and sends project images, saved notes, dimensions, material descriptions and intermediate Blender renders through Cloudflare to OpenRouter and Together. Each approved run permits at most six model responses and two corrected builds, with a $1 maximum model allowance. Provider routing remains pinned, with zero data retention and no data collection requested. Intermediate renders, responses, partial responses and processing checkpoints are saved privately for diagnosis. A successful build does not guarantee visual accuracy.

Use only files you own or are authorised to use for this test. Do not upload personal data, addresses, faces, confidential client information or restricted third party assets. Image metadata is not automatically removed. Uploading does not transfer ownership or grant permission for public display, marketing or model training.

If you contact us

The contact link opens your own email service. If you send an email, we will process your name, email address and message to reply to you and discuss the test you suggested. Please do not send confidential project files until we have confirmed what is suitable.

Purpose and retention

Files and job records support the private workflow test and review of its results. Technical request data supports reliable and secure delivery. Email information is used to answer enquiries. The upload acknowledgement confirms file permissions and awareness of the workflow; it is not blanket consent for unrelated uses of personal data.

A complete automatic deletion period across cloud storage, local copies and backups has not yet been verified. Do not rely on automatic deletion after seven days. Legacy builds normally use temporary folders. Deep Agents jobs retain local source copies, renders, scenes and SQLite checkpoints until manual deletion, including after successful processing. Cloud diagnostics are also retained for manual review. Contact us with the job identifier to request deletion. We will check the copies under our control and explain any retention that remains necessary. Downloaded copies held by other people cannot be removed remotely.

Cloudflare, the optional AI services and the email provider process data needed to deliver their services. We do not promise that all processing occurs only in the EU. The limited internal AI test uses authorised materials without personal or confidential data. Before opening this prototype to clients, we must confirm the responsible legal operator, applicable legal bases, provider agreements, transfer safeguards and enforceable retention rules.

Your choices and rights

You can ask what personal information we hold about you, request a correction or deletion, or object to its use by emailing us. You may also contact the Danish Data Protection Agency at datatilsynet.dk.