Privacy Policy

Last updated: 25 October 2026. Applies to: the Unveil3D Studio, published Unveil3D scenes (share links and embeds) and our related websites.

1. Who we are

Unveil3D is run by Vladislav Kutepov, trading as Vlad Kutepov, a sole trader in South Australia (ABN 90 374 636 715) ("we", "us"). We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). For anything about your privacy, email hello@unveil3d.com.

Unveil3D lets sports clubs turn photos of their players into interactive 3D scenes that they share or put on their own website.

2. Two roles: clubs and the people in their photos

A club (or an agency working for a club) that uses Unveil3D decides which players, photos and details go into its scenes. The club is responsible for having the right to use them and for getting consent from the people pictured, and from a parent or guardian for anyone under 18. We handle that information to provide the service to the club and as this policy describes.

If you are a player, or the parent or guardian of a player, and you want a photo or scene removed, you can ask the club or ask us directly (section 10).

3. What we collect

3.1 Studio account holders (club staff and volunteers).

Email address, and a display name if you give one.
Sign-in records: passkey public keys (never your fingerprint or face: your device keeps those), session records, and a one-way hash of the IP address and browser used to sign in.
Your club or organisation: name, sport, country, team members and their roles, invitations.
A record of important actions (for example publishing, changing roles, recording consent) with who did it and when.

3.2 Players and other people in club content (provided by the club).

Photos of players, which may include children.
Player details the club enters or imports: first name, surname (for under-18s hidden by default and removed from published scenes unless the club turns it on for that person), jersey number, position, height, statistics, taglines.
Whether the person is under 18 (we assume they are until the club says otherwise), and the club's consent record: who in the club confirmed consent, when, and for under-18s the name of the parent or guardian who gave it, including any withdrawal.
If the club generates the announcer voice: the line we turn into speech (the player's position, number and first name, and the surname only if the scene shows it), and the audio clip. For the scene's opening call, the club's name is spoken too. We also keep how each name is pronounced, for that club (6.2).
If the club leaves player sharing on (it is on by default): a random share code for each named player, and two picture cards for each of them (see section 6.3).

3.3 Other club content. Club logos, sponsor logos and names, videos for the scene's wall, colours, titles and other text.

3.4 People who view a published scene. We do not ask visitors to sign in, we do not set cookies on scene pages, and we do not store visitors' IP addresses, browser details or the page they came from. For each visit we count, under a random visit number that is deleted after two days: that a visit happened, how long the scene was visible (up to 30 minutes), which players were looked at and which sponsor logos were shown or clicked. We also count how often a player's share button was used, a shared player link was opened, and a player card was saved. Clubs see these as totals.

The player share links and cards (section 6.3) work the same way: opening one sets no cookie and stores no IP address with us.

Like any website, our hosting provider (Cloudflare) receives your IP address and browser details to deliver the page and protect it from attacks, and keeps operational logs for a limited time (section 7).

3.5 Payments. Payments are handled by Stripe. We never see or store full card numbers. We keep the Stripe customer and subscription identifiers, the plan, invoice and payment status, and refunds or disputes, so we can give you what you paid for.

3.6 Security checks. Our sign-in pages use Cloudflare Turnstile to tell people from bots. Turnstile processes information about your browser and device for that purpose.

3.7 Analytics on our website (unveil3d.com). Only if you say yes. Our marketing website asks first, and until you agree no analytics runs and nothing is stored in your browser for it. If you agree, Google Analytics counts which pages are visited, how far people scroll, and which buttons they press (for example "Start free" or a plan on the pricing page). It runs through Cloudflare Zaraz, which sends the data to Google from Cloudflare's servers, so no Google script runs in your browser. Your IP address is shortened before it is sent. Google Analytics sets cookies in your browser to tell visits apart. You can change your mind at any time with "Privacy choices" in our website's footer. None of this runs in the Studio or in published scenes.

4. What we do not do

No face recognition and no biometric templates. Photos are matched to names using file names and jersey numbers, and a person confirms anything uncertain. The photo checks (section 6) never say who someone is.
We do not sell personal information.
We do not use club photos or player details to train AI models, and we do not let our providers do so.
No advertising or third-party tracking scripts on scene pages.

5. How we use information

To run the service: make cut-outs of players, read jersey numbers, suggest layouts and colours, check photo quality, build and publish scenes, voice the announcer, and show clubs their view counts.
To check for unlawful or harmful content in uploads.
To secure accounts and the service, prevent abuse and enforce our Terms.
To bill clubs and manage plans and credits.
To answer support, consent and removal requests.
To comply with the law.

6. Automated processing (AI)

6.1 Photos. When a club uploads a photo, automated tools on Cloudflare's platform process it:

Cut-out. Cloudflare Images separates the person from the background.
Safety check. An AI vision model looks for nudity or sexual content, graphic violence, hateful symbols and other clearly unsafe content. If it flags a photo, or can't run, the photo is held and can't be used. Nobody reviews a held photo: the club can delete it and upload another.
Framing check. An AI vision model describes the photo's composition: how many main subjects there are, whether a costume is worn, how much of the body is in frame, whether the feet show, the pose, any number printed on the shirt and a few readable words. Where it can, it also gives the midpoint between the eyes and the size of the head.
Eye check. On a head-and-shoulders crop, an AI vision model finds the midpoint between the eyes and the top and bottom of the head. The scene uses this to line up and size the head.

We tell the framing model never to identify anyone or guess their age, ethnicity or any other personal attribute, and the safety model never to identify anyone. The eye check returns only positions in the image. The tools do not say who a person is. The results are suggestions; the club decides what is published.

6.2 Announcer voice. If a club generates the announcer voice, the line for each player goes to Google's Gemini text-to-speech model, which we reach through Cloudflare's AI Gateway: the player's position, number and first name (or a spelling the club types to fix the pronunciation, or the respelling we or the club have chosen for that name), the surname only if the scene shows it, and for the opening call the club's name. No photos go to it. Each part of the line is sent on its own, and a part may be sent again if it didn't come out right. We switch off the AI Gateway's log for these calls. We store the text of each line and its audio clip for the club in private storage, and the clips are included in the published scene.

Saying names right. Our voice first reads each name from its spelling, and a speech-to-text model on Cloudflare Workers AI listens to check it. If it doesn't sound like the name, we send the name, and nothing else, to a text model on Workers AI, which suggests up to three ways to say it, spelled the way they sound. We voice each suggestion (with Google's model, as in 6.2) and keep one that sounds like the name. If none does, the voice reads the spelling and the Studio tells the club the name may sound wrong. We keep each name's pronunciation for the club in private storage, so it isn't worked out again. It's deleted when a player with a saved record is removed from the club, unless another player there has the same name, and when the club is deleted.

When a line is made, the same speech-to-text model listens to the position, number and surname (and, in the opening call, the welcome and the club's name) as each is voiced, and may listen to the whole line (the position, number and names, and the club's name in the opening call). We store what it heard of the whole line with the clip, so the Studio can tell the club when a name may sound wrong, and we delete it with the clip. These speech-to-text and text-model calls go straight to Workers AI, with no AI Gateway log.

6.3 Player share links and cards. When a club publishes a scene, each named player gets a share link and two picture cards: a 1080 x 1350 portrait card and a link-preview image. The Studio draws them in the club member's browser and uploads them with the published scene. A card shows the player's cut-out, first name, number and position, the club's name and crest, and the surname only where the scene shows it. The link carries a random code, not a name; its preview shows the player's first name. Anyone with a player's link can open it, and can open or save that player's cards. This is on by default. The club can switch it off for the whole scene at once, or for one player from the next publish. The links and cards don't work on a scene with a password, one that is unpublished, or one whose end date has passed.

7. Who we share information with

Cloudflare, Inc. (USA, global network): hosting, databases and file storage, image processing, AI models (photo checks, speech-to-text and the name suggestions), bot checks, visitor and Studio statistics, email delivery and security. Data is stored with a location hint for Australia/Oceania where possible, but Cloudflare's network processes requests worldwide and storage location is not guaranteed.
Google (USA), through Cloudflare's AI Gateway: the announcer voice. It gets the text of each announcer line and, when checking how to say a name, the name alone in a short line; never photos (6.2).
Stripe (Stripe Payments Australia Pty Ltd and its affiliates, including in the USA): payments.
The club's audience: whatever the club publishes is visible to anyone who has the link or visits a website where the club embedded it (unless the club adds a password or end date). That includes the audio clips, and the player cards described in section 6.3, which anyone with a player's link can open and save.
Authorities, where the law requires it, and professional advisers.
A buyer of our business, under equivalent privacy protection.

Overseas disclosure (APP 8). Because our providers operate internationally, information may be processed in the United States and other countries where Cloudflare, Google and Stripe operate.

8. How long we keep information

Information	How long
Original uploaded photos	Deleted 30 days after they are processed (the cut-outs are kept)
Announcer audio clips, their text and what speech-to-text heard	Until the club removes the player or deletes the showcase. A clip that any saved version of a scene still names is kept until that version is gone
Name pronunciations for the announcer	Until a player with a saved record is removed from the club (kept if another player there has the same name) or the club is deleted. Each holds how a name is said, filed under a code made from the name, for that club only
Player cards	With the published scene: deleted 30 days after the club deletes the scene, or at once when the player is removed
Cut-outs, logos, player details, scenes	While the club's account is active, until the club deletes them, or until a removal request is completed
Published scene copies
Visit numbers for counting visitors	2 days; the daily totals are kept with the scene
Sign-in links and codes	Minutes; expired records are cleared after 30 days
Consent records and the action log	, so we can show who consented and what was done
Billing records	Stripe keeps invoices and payments as tax law requires (generally 5 years in Australia); our copy goes when the club is deleted

When a club or a person asks us to delete information, we aim to remove it from our systems within 30 days, including stored copies, except where we must keep a record by law.

9. Security

Photos and audio clips are stored privately and are never at a public web address. Published scenes are encrypted and can only be played on the club's own share page or on websites the club allows. Player cards are the exception: they are plain images that anyone with the player's link can open. Access to accounts uses passkeys or single-use email links. We follow the Notifiable Data Breaches scheme: if a breach is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner (OAIC).

10. Your choices and rights

Access and correction (APPs 12 and 13). Ask us for the personal information we hold about you, or to correct it. Club members can correct most details themselves in the Studio.
Removal of a photo or scene. A player, or a parent or guardian of a player under 18, can ask the club or us to remove their photo or take down a scene. We may need to check who you are (without asking for more than we need). Our targets: where a child is at risk, the scene goes offline within 1 hour; a minor's photo without consent, or a withdrawal for a minor, within 24 hours (4 hours if a safety concern is raised); an adult's withdrawal within 2 business days. Stored copies are deleted within 30 days, except what we must keep for the police or eSafety.
Withdrawing consent. Tell the club or us. The club records the withdrawal in the Studio. Every live scene with that person goes offline at once, and an older version showing them can't be made live again.
Complaints. Write to hello@unveil3d.com. We will reply within 30 days. If you are not satisfied, you can complain to the OAIC: www.oaic.gov.au, 1300 363 992.

11. Children

Many clubs have junior players. We treat every person in a photo as possibly under 18 until the club says otherwise. For under-18s, the club must have consent from a parent or guardian before uploading. The Studio treats every named player as under 18 until the club says otherwise, and won't publish a scene with a named under-18 until the club has recorded that consent and the guardian's name, or with a pictured player who has no name yet. Surnames are hidden by default, and published scenes are not indexed by search engines. The Studio is for adults acting for a club; children should not create Studio accounts.

12. Cookies

The Studio uses three strictly necessary cookies to keep you signed in and to complete a sign-in safely (a session cookie, a sign-in-link cookie and a passkey challenge cookie). They are not used for tracking. Scene pages set no cookies. Our marketing website sets Google Analytics cookies only after you agree to analytics (section 3.7), and remembers your choice.

13. Changes

We will post any change here with a new date, and tell club owners by email before a significant change takes effect.