Privacy Policy

1. Data controller

The data controller responsible for your personal data is:

RM7 processes personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), the Law on Legal Protection of Personal Data of the Republic of Lithuania and other applicable data protection laws.

2. Summary

• You can use CrowdBeam without creating an account. The App automatically creates an anonymous user ID for you.
• Holograms you record are processed on your device and stay on your device, unless you choose to upload or share them.
• Background removal is done entirely on your device. We do not send your camera feed to any server, and we do not create biometric or facial recognition profiles.
• We do not sell your personal data, we do not show third-party advertising, and we do not track you across other companies’ apps or websites.
• Payments are handled by Apple. We never receive your card or bank details.
• You can delete your account and the cloud data linked to it at any time from within the App.

3. What data we collect and why

3.1 Anonymous account identifier

When you first open the App, Firebase Authentication creates a random, anonymous user ID (UID). We use it to link your subscription tier, daily usage count, redeemed content and uploads to you, and to keep the App working without asking for your name or email.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

3.2 Sign in with Apple or Google (optional)

If you choose to link an account using Sign in with Apple or Google, we receive your email address and, where you allow it, your name from the provider. When using Sign in with Apple you may choose to hide your real email address, in which case we receive an Apple relay address. We use this data to identify you, restore your account and purchases on other devices, and communicate with you about your account.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

3.3 Marketing consent (optional)

When signing in you may tick a box agreeing to receive news and offers from CrowdBeam. If you do, we store that choice with your account. You can withdraw your consent at any time by contacting [email protected] or by using the unsubscribe link in any message we send.

Legal basis: consent (Art. 6(1)(a) GDPR).

3.4 Display name

You may enter a display name in Settings, or the App may suggest the name provided by Apple or Google. This name is stored only on your device and is used to greet you in the App.

3.5 Holograms, photos and videos you create

• Camera: the App uses your camera to record holograms. Background removal (person and object segmentation) and visual effects are processed locally on your device using Apple’s Vision and Metal frameworks. Depth data (LiDAR / TrueDepth) may be used on supported devices, also on-device only, to separate the subject from the background. The App does not record audio.
• Photo library: the App asks for access only when you import a photo, video or QR code image, or save a hologram to your photo library.
• Recordings and imported scenes are saved in the App’s private storage on your device. They are not uploaded unless you take a sharing action (see 3.6).

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

3.6 Content you upload and share

When you choose to share a hologram or scene by QR code or link, or use Live Session, the App uploads the file (and, for scenes, a thumbnail and title) to our cloud storage and creates a short link in the form crowdbeam.eu/h/{code}. Together with the file we store your UID, the file name, the upload time and a view counter.

Important: anyone who has the short link or scans the QR code can view and download the shared content. Only share content you are entitled to share, and do not upload recordings of other people without their permission.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

3.7 Live Session

If you use Live Session to pair two of your own devices signed in to the same account, we store for each device: a device identifier generated by the App, the device name set in your iOS settings (for example “Anna’s iPhone”), the platform, the role (capture or viewer) and the time it was last active. We also keep a list of holograms broadcast during the session so the viewing device can play them. This data is visible only to devices signed in to your account.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

3.8 Subscriptions and purchases

Subscriptions are purchased through Apple’s App Store. Apple processes your payment; RM7 never receives your payment card details. We receive and store information needed to provide the subscription: the product purchased, your subscription tier, and Apple-signed transaction data (such as the transaction identifier, purchase and expiry dates), which our server verifies to activate your plan.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations, such as accounting and tax rules (Art. 6(1)(c) GDPR).

3.9 Usage limits, content packs and redeem codes

To enforce the limits of your plan we store a daily count of holograms you create. When you redeem a code or download a content pack, we store which pack you are entitled to, how you obtained it (for example the redeem code used) and a record of which pack items you have downloaded, so your content is available on all your devices.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

3.10 Crash and diagnostic data

We use Firebase Crashlytics to understand and fix crashes. When the App crashes, a report is sent containing technical information such as a stack trace, device model, operating system version, app version, an installation identifier and the state of the App at the time of the crash. Crash reports do not include the content of your recordings.

Legal basis: our legitimate interest in keeping the App stable and secure (Art. 6(1)(f) GDPR).

3.11 Data stored only on your device

Your App preferences (for example capture quality, recording duration, layout and effect settings) are stored locally on your device and are not sent to us.

3.12 Data we do NOT collect

We do not collect your precise location, contacts, microphone audio, advertising identifier (IDFA), browsing history, or health data. We do not use your data for profiling, automated decision-making with legal effects, or targeted advertising.

4. Who stores and processes your data

RM7, UAB is the controller of your personal data. We use carefully selected service providers (“processors”) who process data on our behalf, under written data processing agreements and only according to our instructions:

• Google Ireland Limited / Google LLC (Firebase) — authentication, database (Cloud Firestore), file storage (Cloud Storage), server functions (europe-west1, Belgium) and crash reporting (Crashlytics). This is where your account data, uploads, entitlements and usage records are stored.
• Apple Distribution International Ltd. / Apple Inc. — App distribution, Sign in with Apple and in-app purchase payment processing. Apple acts as an independent controller for payment data; see Apple’s Privacy Policy.
• Google (Sign in with Google) — if you choose Google sign-in, Google acts as an independent controller for your Google account; see policies.google.com/privacy.
• Cloudflare, Inc. — hosting, content delivery and security for the crowdbeam.eu website and short links.

We may also disclose personal data:

• to competent authorities, courts or law enforcement where required by law;
• to professional advisers (lawyers, accountants, auditors) bound by confidentiality;
• to a successor entity in the event of a merger, acquisition or sale of all or part of our business, in which case you will be informed.

We never sell or rent your personal data.

5. International data transfers

We aim to store and process your data within the European Economic Area (EEA). Some of our service providers (Google, Apple, Cloudflare) are part of groups headquartered in the United States and may process data outside the EEA. Where this happens, transfers are protected by an adequacy decision of the European Commission (including the EU–US Data Privacy Framework, where the provider is certified) or by the European Commission’s Standard Contractual Clauses, together with additional safeguards where required.

6. How long we keep your data

• Recordings and scenes on your device: until you delete them or uninstall the App. We have no access to them.
• Account data (UID, tier, linked sign-in email, marketing consent): for as long as your account exists. It is deleted when you delete your account.
• Uploaded / shared content and short links: until you delete it, delete your account, or it is removed under the storage period of your subscription plan.
• Live Session device and broadcast records: until you delete your account.
• Daily usage counts, entitlements and download records: for as long as your account exists.
• Purchase and transaction records: for as long as required by applicable accounting and tax laws (in Lithuania, generally up to 10 years).
• Crash reports: up to 90 days, as defined by Firebase Crashlytics.
• Marketing consent: until you withdraw it or delete your account.
• Emails you send to us: for as long as needed to handle your request, and no longer than 3 years unless required by law.

7. Deleting your account

You can delete your account at any time in the App: Settings → Account → Delete Account. This permanently deletes:

• your authentication account and linked sign-in details;
• your user profile, subscription tier record, usage counts and marketing consent;
• your Live Session devices and broadcast history;
• your entitlements, download records and short links;
• all holograms and scenes you uploaded to our cloud storage;
• content packs downloaded to that device.

Holograms and scenes saved only on your device are not deleted automatically, so you keep your own creations; you can remove them in the App or by uninstalling it. Deleting your account does not cancel an active App Store subscription. Please cancel it in your Apple ID settings (Settings → [your name] → Subscriptions) or via Settings → Account → Manage Subscription in the App.

Some data may remain in backups for a limited time (normally no more than 30 days) before being overwritten, and transaction records may be retained where required by law. If you cannot access the App, you can request deletion by emailing [email protected].

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• rectification of inaccurate or incomplete data;
• erasure (“right to be forgotten”);
• restriction of processing;
• data portability — receive your data in a structured, machine-readable format;
• object to processing based on our legitimate interests;
• withdraw consent at any time, without affecting processing carried out before the withdrawal;
• not be subject to decisions based solely on automated processing.

To exercise any of these rights, contact [email protected]. Because accounts are anonymous by default, we may ask you to verify that the account belongs to you (for example by sending the request from the email linked to your account, or by providing your user ID shown in the App). We will respond within one month; this may be extended by two further months for complex requests, in which case we will inform you.

You also have the right to lodge a complaint with a supervisory authority. In Lithuania this is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, LT-10312 Vilnius, [email protected], vdai.lrv.lt. You may also contact the data protection authority in the EU country where you live or work.

9. Data security

We use appropriate technical and organisational measures to protect your personal data, including encryption in transit (HTTPS/TLS), encryption at rest provided by our cloud infrastructure, access rules that restrict each user to their own account data, server-side verification of purchases, and restricted internal access on a need-to-know basis. No method of transmission or storage is completely secure, but we work to protect your data and will notify you and the authorities of a personal data breach where required by law.

10. Children

The Services are not directed at children under the age of 14. We do not knowingly collect personal data from children under 14 without the consent of a parent or legal guardian. If you believe a child has provided us with personal data, please contact [email protected] and we will delete it.

11. Third-party links and content

The App and Website may contain links to third-party websites or services, including shared links created by other users. We are not responsible for the privacy practices of third parties, and we encourage you to read their privacy policies.

12. Website

When you visit crowdbeam.eu or open a short link, our hosting and security provider automatically processes technical data such as your IP address, browser type, requested page and time of access, in order to deliver the page and protect it against abuse. This data is kept only for a short period in server and security logs. The Website uses only cookies that are strictly necessary for it to function. If we introduce analytics or other non-essential cookies, we will ask for your consent first and update this Policy.

Legal basis: our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example when we add new features or when the law changes. The “Last updated” date at the top shows when it was last changed. If we make significant changes, we will notify you in the App or by other appropriate means before the changes take effect.

14. Contact us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact: