← Back to Retor

Privacy Policy

Last updated: March 1, 2026

1. Who We Are

Retor is operated by Bag of Marshmallows AB, a company registered in Sweden. In this policy, “we”, “us”, and “our” refer to Bag of Marshmallows AB. “Retor” or “the Platform” refers to our website, applications, APIs, and related services.

2. Information We Collect

Account information

When you create an account we collect your name, email address, and authentication credentials provided through our identity provider (Clerk). We may also store a profile picture if you choose to provide one.

Uploaded content

You may upload videos, images, and other source material (“Source Material”) to the Platform. We store and process this content to generate 3D Gaussian splats, point clouds, spatial indices, and related outputs (“Generated Content”).

Usage data

We automatically collect information about how you interact with the Platform, including pages visited, features used, timestamps, browser type, and device information. This data helps us improve the service.

3. How We Use Your Information

  • Provide, operate, and maintain the Platform
  • Process Source Material to generate 3D content and spatial data
  • Improve and develop new features for the Platform
  • Communicate with you about your account, updates, and support requests
  • Enforce our Terms of Service and prevent misuse
  • Comply with legal obligations

Legal basis (GDPR)

We process your data under the following lawful bases: Contract performance — processing Source Material and delivering Generated Content is necessary to provide the service you signed up for. Legitimate interest — improving the Platform, analytics, and fraud prevention, where these interests are not overridden by your rights. Legal obligation — where required by applicable law. Consent — where you have given explicit consent, which you may withdraw at any time.

4. Where Your Data Is Processed

We use third-party infrastructure providers to operate the Platform. Your data may be processed in the following locations:

  • United States — Core application database and backend (Convex)
  • Multiple regions — File storage and media delivery (Bunny.net), with CDN edge locations worldwide
  • United States — AI model inference for spatial processing (Google Gemini, xAI Grok)
  • United States — GPU compute for 3D generation (Modal)

By using the Platform you consent to the transfer of your data to these locations. We ensure that all providers maintain appropriate security measures.

5. Data Retention

We retain your account information for as long as your account is active. Source Material that you delete through the Platform will be removed from active storage. Aggregated, anonymised usage data may be retained indefinitely for analytics purposes.

You may request full deletion of any project or your entire account and all associated data (including Generated Content) by contacting us at legal@retor.io. Deletion requests are processed manually within 30 days. See our Terms of Service for details.

6. Data Sharing

We do not sell your personal information. We may share data with:

  • Infrastructure providers necessary to operate the Platform (listed in Section 4)
  • Law enforcement or regulatory authorities when required by applicable law
  • A successor entity in the event of a merger, acquisition, or sale of assets

7. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your account and personal data
  • Object to or restrict certain processing activities
  • Request data portability

To exercise these rights, contact us at the address below. Note that deletion of your account does not necessarily remove Generated Content — see our Terms of Service for details.

8. Cookies

We use essential cookies required for authentication and session management. We do not use third-party advertising or tracking cookies.

9. Security

We implement industry-standard security measures to protect your data, including encrypted connections (TLS), access controls, and secure authentication. However, no system is completely secure, and we cannot guarantee absolute security.

10. Children

The Platform is not intended for users under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Platform with a revised “Last updated” date. Continued use of the Platform after changes constitutes acceptance of the updated policy.

12. Contact

For questions about this Privacy Policy or to exercise your data rights, contact us at:

Bag of Marshmallows AB
Email: privacy@retor.io

© 2026 Bag of Marshmallows AB. All rights reserved.