Privacy Policy

Last updated: October 25, 2026

This Privacy Policy explains how Adeveda Enterprises Private Limited ("Mixar," "we," "us," or "our") collects, uses, discloses, and protects personal information when you use our website, the Mixar desktop application, our design tools, and related services (collectively, the "Service"). It also explains the privacy rights available to you and how to exercise them.

By using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with it, please do not use the Service.

1. Scope

This Policy applies to personal information we process in connection with the Service, including our website, the Mixar desktop application, APIs, design tools, and related online offerings.

This Policy does not apply to:

Third-party websites, applications, or services you use independently of Mixar, which have their own privacy policies;
Personal information relating to our employees, contractors, and job applicants, which is governed by a separate notice available on request.

This Policy covers Mixar's collection, use, and sharing of information with third-party AI providers as part of the Service, including the processing described in Section 5.

2. Information We Collect

2.1 Information you provide to us

Category	Examples
Account data	Name, email address, and profile details you provide when you register or sign in (including via Google sign-in)
Content	3D models, textures, files, prompts, and other materials you upload to, or generate using, the Service ("Content")
Billing data	Your subscription plan and transaction history. Full payment card details are collected and processed directly by our payment processor, Dodo Payments; we do not store full card numbers on our own systems
API keys (BYOK)	Credentials stored locally on your device and processed transiently to authenticate your requests, as described in Section 5.
Communications	Information you provide when you contact support, report a bug, or otherwise reach out to us

2.2 Information we collect automatically

Usage data — features used, actions taken, generation activity, and associated account and session identifiers. We use Google Analytics for website analytics and PostHog for desktop product analytics, as described in Section 8.
Diagnostic records — we may record AI and connected-tool requests processed through the Service for troubleshooting and service improvement. These records may include MCP tool inputs and results, prompts included in those inputs, and technical context.
Device and log data — browser and device type, operating system, app version, IP address, and timestamps.
Cookies and similar technologies — see our Cookie Policy for website cookies and related controls.

We do not knowingly collect more personal information than is reasonably necessary to provide and improve the Service.

3. How We Use Your Information

We use personal information to:

Provide, operate, secure, and maintain the Service, and personalize your experience within it;
Process your inputs and deliver AI-generated outputs, including sending information needed for your requests to third-party AI providers used by Mixar's included AI features or connected through BYOK;
Process payments, manage subscriptions, detect fraud, and enforce billing terms;
Communicate with you about your account, security notices, updates, and support requests;
Analyze and improve the Service, diagnose technical issues, and understand aggregate usage trends;
Comply with legal obligations and enforce our Terms of Service and Acceptable Use Policy.

3.1 Model training and product analytics

Mixar does not currently use your Content or usage data to train or fine-tune AI models. We use usage analytics to understand feature use, diagnose issues, and improve the Service. Third-party AI processing is described in Section 5.

Any future change to this practice will be subject to advance notice and any consent or other requirements under applicable law.

3.2 Legal bases for processing

Where applicable law requires a legal basis for processing personal information, we rely on the following bases, as appropriate to the purpose:

Contract — processing necessary to perform our agreement with you, including managing your account, providing the Service you request (including AI features), processing payments, and providing support necessary to deliver that Service.
Legal obligations — processing necessary to comply with applicable legal obligations, including required recordkeeping and responding to legally binding requests.
Legitimate interests — processing necessary for our interests in securing the Service, preventing fraud, diagnosing technical issues, and understanding feature use to improve the Service (including desktop product analytics, which you can turn off at any time as described in Section 8), where permitted by applicable law and not overridden by your interests or fundamental rights and freedoms.
Consent — for optional processing, including website analytics and non-essential cookies or similar technologies, where applicable law requires consent. You may withdraw consent at any time, as described in Sections 8 and 10.

We do not rely on legitimate interests where applicable law requires consent.

4. Ownership of Content and AI-Generated Outputs

Your Content remains yours. As between you and Mixar, you retain all rights, title, and interest in your Content. You grant Mixar only the limited license needed to operate the Service, as set out in our Terms of Service.
AI-generated outputs. Ownership of outputs generated using the Service is governed by our Terms of Service. Because outputs may be produced using third-party AI models (including via BYOK), your rights in a given output may also be subject to that provider's terms, and you are responsible for ensuring your use of any output complies with applicable law and third-party rights.
Nothing in this Policy transfers ownership of your Content to Mixar.

5. Third-Party AI Providers and BYOK

5.1 Third-party AI processing

We engage third-party AI providers and hosting platforms, including OpenAI, Anthropic, Google, OpenRouter, fal.ai, Replicate, Tripo, Meshy, and World Labs, to support AI assistance and content generation. These services may also provide access to models developed by other providers. This applies to both Mixar's included AI features and BYOK integrations.

To fulfill your requests, we may disclose prompts, uploaded materials, and relevant conversation or project context to the applicable provider or platform. The recipient depends on the feature and model used. Provider processing is subject to applicable contractual arrangements, terms, and privacy policies. Mixar's collection, use, and disclosure of your information remain governed by this Policy.

5.2 Bring Your Own Key (BYOK)

BYOK credentials are stored locally on your device and are not retained in Mixar's backend storage. We process them transiently to validate and authenticate your requests, using encryption in transit.

You may remove locally saved credentials through the app's provider settings. Signing out does not delete those credentials, and removing them from Mixar does not revoke them with the provider. Your use of a provider through BYOK is also subject to the terms applicable to your provider account.

6. How We Share Your Information

We do not sell your personal information or share it for cross-context behavioral advertising. We may share personal information with the following persons or for the following reasons:

Service providers who process data on our behalf under contracts requiring appropriate confidentiality and security safeguards - for example, cloud hosting providers, payment processing (Dodo Payments), analytics (Google Analytics and PostHog), diagnostic and monitoring services, and email delivery providers.
Third-party AI providers - to fulfill your requests through Mixar's included AI features or providers you connect through BYOK, as described in Section 5.
For legal reasons - to comply with applicable law, respond to lawful requests from public authorities, or protect the rights, safety, and property of Mixar, our users, or the public.
In a business transfer - in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to this Policy or a materially equivalent one.

We maintain a current list of categories of service providers and sub-processors and will make it available on request.

7. International Data Transfers

Mixar is based in India. Your personal information may be processed in India, the United States, or other countries where we or our service providers operate. These countries may have data protection laws that differ from those in your jurisdiction.

International transfers are subject to applicable data protection requirements. Where applicable, we rely on transfer safeguards incorporated into our service providers' data processing terms, including standard contractual clauses. You may contact [email protected] for information about, or a copy of, the safeguards applicable to your personal information.

8. Cookies and Analytics

We use Google Analytics for website analytics and PostHog for desktop product analytics to understand usage, assess performance, and improve the Service. Analytics may include usage events, technical information, and activity associated with your account. Desktop usage analytics exclude your prompts, file names, and scene content.

Google Analytics runs on the website only after you accept analytics cookies; if you decline, no analytics data is sent to Google. You may change your choice at any time through Cookie settings. See our Cookie Policy for further information and controls.

Desktop usage analytics are enabled by default and rely on our legitimate interests in understanding feature use and improving the Service (Section 3.2). You may opt out at any time by turning off Share Usage Data under Edit → Preferences → System → Privacy on each device. Website cookie choices and desktop analytics preferences are separate. Disabling optional analytics does not affect processing necessary to provide, bill for, or secure the Service.

The diagnostic records described in Section 2.2, including records of in-app AI requests and MCP tool calls, are separate from optional usage analytics and are not turned off by Share Usage Data. They are deleted as described in Section 9.

See Section 10 for your privacy rights and how to exercise them.

9. Data Retention

We retain personal information for as long as reasonably necessary to maintain your account, provide the Service, and fulfill the purposes described in this Policy. Desktop usage analytics held in PostHog are retained for 30 days.

We delete the diagnostic records described in Section 2.2 from our active systems and those of service providers processing them on our behalf within 30 days of collection, including while your account remains active, subject to the retention exceptions and backup provisions below.

You may delete your account at any time from Settings → Delete my Account on the website, or by contacting [email protected]. Following a verified deletion request, we will delete or irreversibly anonymize your personal information, including copies held by service providers processing it on our behalf, within 30 days, subject to the exceptions below and any shorter deadline required by applicable law. We will notify other recipients of your personal information of the deletion where required by applicable law.

Certain records may be retained longer where required or permitted by applicable law, including for tax, accounting, fraud prevention, security, or the establishment, exercise, or defence of legal claims. Access to these records is restricted, and they are retained only for the applicable purpose and period. Backup copies are isolated from active use and deleted or overwritten under established backup-retention schedules, subject to applicable law.

For diagnostic records, backup copies are kept isolated from active use and deleted within 7 days of backup creation, subject to the lawful retention exceptions above. Copying or restoring a backup does not restart that period, and expired diagnostic records are removed before restored data returns to active use.

10. Your Privacy Rights and Contact

Depending on your location and applicable law, you may have the right to access, correct or delete your personal information, obtain a portable copy, restrict processing, withdraw consent, or opt out of certain disclosures.

You may also have the right to object to processing. Where processing relies on consent, withdrawal will not affect the lawfulness of processing carried out before withdrawal.

To exercise your rights or raise a privacy question or concern, contact [email protected]. We may verify your identity where necessary and will respond within the periods required by applicable law. These rights are subject to statutory conditions and exceptions.

You may also lodge a complaint with the competent data protection authority, where applicable. We will not discriminate against you for exercising your privacy rights.

11. Children's Privacy

The Service is intended for individuals who have attained the age of majority in their jurisdiction, as required by our Terms of Service. We do not knowingly collect personal information from individuals below that age. If you believe such information has been provided to us, contact [email protected] so that we can investigate and delete it as appropriate.

12. Security

We implement technical and organizational measures designed to protect personal information, including:

Protection of locally saved BYOK API keys through your operating system's credential store, and encryption of those keys on your device before transmission to Mixar;
Encryption of other sensitive credentials at rest, and TLS encryption in transit;
Access controls limiting internal access to personal information on a need-to-know basis;
Regular review of our security practices.

Mixar has completed a SOC 2 Type II audit and holds ISO/IEC 27001 certification. Visit our Trust Centre for information about our security and compliance.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you and relevant authorities as required by applicable law.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a revised "Last updated" date and, for material changes, provide additional notice (such as an in-app notification or email) where appropriate.

14. Governing Law

This Policy is governed by the laws of India, without regard to conflict-of-law principles. Any disputes arising out of or relating to this Policy will be subject to the exclusive jurisdiction of the courts at New Delhi, India, without prejudice to any mandatory consumer protection or data protection rights you may have in your own jurisdiction.