BANANA-GOAT is operated by Wallnah, trading as BANANA-GOAT. For the purposes of applicable data protection law, including the General Data Protection Regulation (GDPR), Wallnah is the controller of personal data described in this policy unless we clearly state otherwise.

Our contact details are: Wallnah, Piet Heinstraat 12, 7511 JE Enschede, Netherlands. You can contact us about privacy matters at info@banana-goat.com.

We collect information you provide directly to us, information generated through your use of the service, and limited technical information needed to operate, secure, and improve BANANA-GOAT.

The types of information we collect depend on how you use the service, such as creating an account, uploading models, generating share links or embeds, opening viewer links, contacting support, or paying for a subscription.

• Account and profile information, such as your name, email address, company name, login credentials, and account preferences
• Authentication information from sign-in providers if you use Google, Apple, or GitHub login
• Billing and transaction information, such as plan details, subscription status, invoices, and payment-related records processed through Stripe
• Uploaded content and related metadata, such as source model files, filenames, processing metadata, generated viewer artifacts, model settings, and library records
• Share and embed records, such as tokenized links, embed status, and related publishing metadata
• Analytics and usage information, such as viewer events, timestamps, country, and approximate region for shared and embedded views
• Support and communications information, such as messages sent through forms, email, support requests, and related correspondence
• Technical and security information, such as device, browser, application, error, and service logs needed to maintain reliability, prevent abuse, and secure the platform

We use personal data to operate BANANA-GOAT, provide the secure 3D viewing service, manage accounts and subscriptions, maintain security, support customers, and improve the platform.

We do not treat customer model uploads as a general-purpose file hosting library. We use uploaded content to process, generate, deliver, and manage the secure viewer experience that the customer requests.

• Provide account access, authentication, and customer library features
• Process uploaded 3D models into BANANA-GOAT viewer outputs
• Host, deliver, and manage share links, embeds, and viewer presentation
• Process subscriptions, invoices, payments, and account administration
• Measure service usage, viewer activity, and product performance
• Respond to support requests, product inquiries, and legal or operational communications
• Prevent fraud, abuse, unauthorized access, scraping, and other misuse
• Maintain platform reliability, troubleshoot errors, and improve our services
• Comply with legal obligations and enforce our terms, policies, and contracts

Where the GDPR or similar laws apply, we rely on one or more legal bases depending on the processing activity. In many cases, we process data because it is necessary to provide the service you request or to take steps before entering into a contract with you.

We also process data where necessary for our legitimate interests, such as operating a secure and reliable service, preventing misuse, improving the platform, and communicating with customers, provided those interests are not overridden by your rights.

• Performance of a contract or steps taken at your request before entering into a contract
• Compliance with legal obligations
• Our legitimate interests in running, securing, supporting, and improving BANANA-GOAT
• Consent where required by law, for example for certain optional cookies or communications

We do not sell personal data. We share personal data only where needed to provide and support the service, comply with the law, protect rights and security, or complete corporate transactions.

In some situations, BANANA-GOAT acts as the controller of personal data, for example for account administration, subscriptions, billing, support, security, website operations, and our own product analytics. In other situations, we may process personal data on behalf of business customers who use BANANA-GOAT to publish or manage viewer experiences for their own users. In those cases, the business customer is typically the controller for that data and BANANA-GOAT acts as a processor or service provider on the customer's behalf.

• Hosting, storage, and infrastructure providers, including Microsoft Azure
• Payment and billing providers, including Stripe
• Authentication, communication, monitoring, analytics, customer support, and security providers
• Professional advisers such as legal, accounting, audit, or insurance advisers where needed
• Law enforcement, regulators, courts, or other third parties where required by law or where necessary to protect rights, safety, or the platform
• A buyer, investor, successor, or affiliate in connection with a merger, acquisition, reorganization, financing, or sale of assets

BANANA-GOAT is based in the Netherlands and we expect to launch with primary hosting in Europe, but we may process or make data available in other countries, including the United States, as the service grows or where service providers operate globally.

When personal data is transferred outside the European Economic Area, the United Kingdom, or Switzerland, we use appropriate safeguards where required by law, such as adequacy decisions, Standard Contractual Clauses, or other lawful transfer mechanisms.

We keep personal data only for as long as reasonably necessary for the purposes described in this policy, including to provide the service, maintain records, resolve disputes, enforce agreements, protect the platform, and comply with legal obligations.

Retention periods may vary based on the type of data, the customer relationship, operational needs, legal requirements, and whether the data is needed for security, billing, or support.

• Source uploads are deleted automatically after processing completes, without guaranteeing a specific deletion timeframe
• Processed viewer artifacts are retained in the customer's library until the customer deletes them or the related account is deleted, subject to limited backup or technical cleanup delays
• Account information is generally retained while the account remains active and afterward only as needed for legal, accounting, fraud-prevention, security, or contractual reasons
• Viewer analytics records are generally retained for up to 12 months
• Support and contact records are generally retained for up to 24 months after the last relevant interaction
• Operational and security logs are generally retained for up to 90 days unless a longer period is needed for security, incident investigation, or legal compliance

We use cookies and similar technologies to operate BANANA-GOAT, keep users signed in, maintain sessions, remember preferences, and support secure upload, account, billing, and viewer workflows.

We may also use limited cookie-based or similar technologies for security, fraud prevention, service diagnostics, and permitted analytics. If we use non-essential cookies or similar technologies, we will request consent where required by law.

Please also see our Cookies page for more detail about session, authentication, and cookie-related behavior.

We use technical and organizational measures designed to protect personal data and customer content against unauthorized access, loss, misuse, or disclosure. However, no service can guarantee absolute security.

BANANA-GOAT is designed to transform uploaded source models into a viewer-oriented runtime representation rather than treating the original source file as the normal public delivery asset. Even so, customers should not interpret this as a promise of absolute, forensic-grade, or DRM-grade protection.

Depending on where you live and subject to applicable law, you may have the right to request access to your personal data, ask us to correct or delete it, restrict certain processing, object to certain processing, or request portability of data you provided to us.

Where we rely on consent, you may withdraw that consent at any time, although this will not affect processing that already took place before withdrawal. You may also have the right to lodge a complaint with your local supervisory authority, including the Dutch Data Protection Authority.

• Access the personal data we hold about you
• Correct inaccurate or incomplete personal data
• Request deletion of personal data in appropriate circumstances
• Restrict or object to certain processing
• Receive a portable copy of certain personal data
• Withdraw consent where consent is the legal basis
• Lodge a complaint with a competent supervisory authority

We may need to verify your identity and may decline or limit certain requests where permitted by law.

BANANA-GOAT is not intended for children under 16, and we do not knowingly collect personal data from children under 16 in connection with the service.

If you believe that a child under 16 has provided personal data to us, please contact us at info@banana-goat.com so we can review and take appropriate action.

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, security practices, or business operations. When we make material changes, we will post the updated version on this page and update the effective date or other notice as appropriate.

If you have questions about this Privacy Policy, want to exercise your rights, or want to contact us about privacy or data handling, please contact Wallnah, trading as BANANA-GOAT, at info@banana-goat.com or by post at Piet Heinstraat 12, 7511 JE Enschede, Netherlands.