Legal

Privacy Policy

Last updated: July 2026

1. Introduction

Arenex Studios ("we," "our," or "us") provides cloud-streamed architectural visualization services. This Privacy Policy explains how we collect, use, and protect information when you visit our website or use our streaming service.

By accessing our website or using a protocol key to initiate a stream session, you acknowledge the practices described in this policy.

2. Information We Collect

We collect the following categories of information:

a. Session & Access Data

When you use a protocol key to access our streaming service, we log:

IP address — recorded at connection time for security monitoring, rate-limit enforcement, and abuse prevention.
Connection timestamps — when a session starts and ends.
Usage duration — the total time your session remains active, used solely to enforce per-key session limits.
Protocol key identifier — the unique key used to authenticate your session. This is a random identifier and does not contain personal information.

This data is collected automatically by our backend infrastructure for the legitimate purpose of operating, securing, and billing the service. It is never used for user profiling or sold to third parties.

b. Website Analytics & Advertising

We use the LinkedIn Insight Tag, a JavaScript snippet provided by LinkedIn Corporation, to collect limited browsing data on our website. This tag sets a first-party cookie on your browser when you visit our site and may transmit the following to LinkedIn:

Page URLs visited
Referrer URL
Browser and device information
Timestamps of visits
A hashed or anonymized identifier linked to your LinkedIn account (if you are logged in)

This data enables us to measure the effectiveness of our marketing campaigns and to show relevant advertisements to visitors who have previously browsed our site (website retargeting). LinkedIn processes this data in accordance with its own privacy policy.

This tag only activates after you explicitly accept cookie tracking via the consent banner displayed on our site. No data is sent to LinkedIn before you provide consent.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, our processing of your personal data is based on the following lawful grounds:

Legitimate interests — for session data (IP, timestamps, usage time) that is strictly necessary to operate and secure the streaming service and prevent abuse.
Consent — for the LinkedIn Insight Tag and any non-essential cookies. You may withdraw consent at any time by clearing your browser cookies and declining the consent banner on your next visit.

4. Data Sharing

We do not sell your personal data. We share data only in these limited circumstances:

LinkedIn Corporation — receives anonymized browsing data via the Insight Tag (only after your consent) for advertising and analytics purposes as described in Section 2b.
Supabase Inc. — our database provider. Session data (IP, timestamps, usage) is stored on Supabase's infrastructure. Supabase acts as a data processor and does not access this data for its own purposes.
Law enforcement or legal obligation — if required by applicable law or valid legal process.

5. Data Retention

Session logs (IP, timestamps, usage time): retained for the duration of the key's validity period plus up to 12 months for security audit purposes.
Insight Tag data: retained by LinkedIn in accordance with their data retention policy. You can manage your LinkedIn ad preferences through your LinkedIn account settings.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

Access the personal data we hold about you.
Request correction or deletion of your data.
Object to or restrict processing of your data.
Data portability.
Withdraw consent at any time (without affecting the lawfulness of processing before withdrawal).

To exercise these rights, contact us using the information in Section 8.

7. Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS for all web traffic, WebRTC with DTLS-SRTP for streaming), restricted access to backend systems, and a zero-trust architecture where the browser never directly accesses the database. However, no method of transmission over the Internet is 100% secure.

8. Contact

For questions about this Privacy Policy, to exercise your data rights, or to report a concern, you can reach us through the contact form on our website or by initiating a project inquiry.

Arenex Studios
arenexstudios.com