Privacy Policy

Last updated: 21 October 2026. Version 1.0. This policy covers the serra.tech website, Loom for Blender and Loom for Windows, your Serra account, and correspondence with us. It is published by SERRA TECHNOLOGIES PTY LTD (ABN 84 702 332 054), an Australian company ("Serra"), which is the data controller. What we collect and why Your Serra account. You sign up with an email address and password, or with Google. Our sign-in service, run for us by Auth0, holds your email address, a hash of your password, your name and profile picture if you used Google, and a log of sign-ins with IP addresses. Loom's servers hold a random account identifier, a link to that sign-in identity, your account status, and hashed sign-in keys labelled with the computer they were created on. The Loom add-on keeps its key and the account email shown in the Loom panel in your user configuration folder. Google user data. If you sign in with Google we receive your Google email address, name and profile picture. We use them to create and identify your Serra account and to contact you as described below. We share them only with the processors below. Manage our access at myaccount.google.com/permissions. What you send to Loom. Your messages, a summary of your Blender scene, Viewport screenshots and images you attach, the code Loom generates to act on your scene, and the output from running that code, including results and error messages. Loom's servers send this to the AI model providers below to produce the response. Under their API terms, neither Anthropic nor OpenAI uses it to train their models. Usage data. Each interaction is recorded as a trace in Langfuse: the conversation, scene metadata, images, the code Loom generates and the output from running it, timings, your Blender and operating system versions, and your account identifier. We use it to diagnose failures and to improve Loom. It is sent by default and can be turned off in Blender under Edit → Preferences → Add-ons → Loom → Enable telemetry. Balance. We keep a ledger of credits added to and spent from your Serra account balance. Email. We send verification codes, password resets and account notices through Resend. We may also email you to ask for feedback or to tell you about changes and updates to Loom; you can opt out of those at any time. Website. Hosted by Crazy Domains, which keeps standard server logs including IP addresses. Correspondence. When you write to us we keep the exchange, including your email address. Legal bases Processing - Basis Serra account, requests to Loom, balance, transactional email - Performance of our contract with youUsage data - Legitimate interest; you can turn it off in the Loom add-on's preferences Security logging - Legitimate interestFeedback requests and product updates by email - Legitimate interest; you can opt out Records the law requires - Legal obligation An email address is required to open a Serra account; nothing else is mandatory. Who we share it with These providers process your personal information on our instructions; each name links to that provider's data processing agreement: Provider - Role - What they hold - Where - Retained Auth0 (Okta, Inc.) - Sign-in - Email, password hash, name, picture, sign-in logs - United States - While your account exists Render Services, Inc. - Hosting and database for Loom's servers - Account identifiers, key hashes, balance ledger - United States - While your account exists; backups 7 days OpenAI, L.L.C. and Anthropic, PBC - AI model providers that produce Loom's responses - Prompts, scene data and images - United States - Per their terms, linked above Langfuse Cloud (ClickHouse, Inc.) - Usage data traces - Interaction traces as above - United States - While your account exists Resend, Inc. - Email delivery - Email address, delivery status - United States - Per its terms Crazy Domains (Dreamscape Networks) - Website hosting - Server logs - Australia - Per its terms We may also disclose information where the law requires it, or to a successor if Serra's business is transferred. Apart from our website host, these providers are in the United States, so your personal information is sent to and stored there. For EU and UK users, these transfers are covered by the Standard Contractual Clauses in those agreements. Data is encrypted in transit and at rest, and passwords and sign-in keys are stored only as hashes. When you ask us to delete your Serra account, we delete it except for records we must keep by law. We keep correspondence and anything else for as long as the purposes above need it or the law requires. Your rights You can ask us to access, correct or delete your personal information. If you are in the EU or UK, you can also object to or restrict its processing and ask for a copy in a portable format. Email privacy@serra.tech from your Serra account address. Complaints Write to privacy@serra.tech first and we will investigate and reply. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au), to your EU member state's data protection authority, or to the UK Information Commissioner's Office (ico.org.uk). Changes We update the date and version above when this policy changes. Contact SERRA TECHNOLOGIES PTY LTD, ABN 84 702 332 054 privacy@serra.tech