Privacy Policy

Moshpit XR, LLC is the controller or business responsible for personal information it uses for account administration, billing, security, support, service analytics, product improvement, and its own marketing.

Business customers may upload or collect personal information in Customer Content or through their hosted experiences. For that information, the customer generally determines the purposes and means of processing, and Moshpit acts as the customer's processor or service provider under the customer's instructions and any applicable Data Processing Addendum. Individuals should direct requests about customer-controlled content first to the customer that published or collected it.

This Policy applies to Account holders, customer personnel, website visitors, prospective customers, Viewers of hosted experiences, and people who contact Moshpit.

The information collected depends on how you interact with the Service.

2.1 Information You Provide

• Account and contact information, such as name, email address, organization, role, username, password or authentication token, profile information, billing address, and telephone number if provided;
• Commercial and transaction information, such as plan, Order, subscription status, purchases, credits, invoices, tax information, and payment status. Payment processors generally receive full payment-card details; Moshpit typically receives a token and limited transaction details;
• Communications, including support requests, survey responses, sales inquiries, meeting notes, feedback, and records of consent or preferences;
• Workspace and collaboration information, such as organization membership, invitations, roles, permissions, project names, domains, and integration settings;
• Marketing information, such as event registrations, newsletter preferences, campaign interactions, and business contact information.

2.2 Customer Content and Generated Output

The Service may process Unreal Engine scenes or project materials, 3D assets, meshes, textures, point clouds, scans, images, video, audio, prompts, annotations, scene metadata, brand assets, documents, links, and other files uploaded or connected by a customer, as well as Generated Output. This content may incidentally include faces, voices, names, homes, workplaces, license plates, location clues, documents, or other personal information.

2.3 Information Collected Automatically

• Device and network data, such as IP address, browser, operating system, device type, language, time zone, approximate location derived from IP, identifiers, and connectivity information;
• Usage and event data, such as pages and features used, projects opened, conversions requested, processing status, API calls, interactions, clicks, session times, referrer, link or embed access, and error or crash information;
• Performance and diagnostic data, such as load times, graphics capabilities, GPU or memory tier, compatibility results, bandwidth, logs, and security events;
• Cookie and similar-technology data described in Section 9.

2.4 Viewer, Lead, and AI Interaction Information

When a person views a hosted experience, we may collect device, usage, performance, approximate-location, and security information. If a Viewer voluntarily submits a name, email, message, appointment request, or other lead information, we process it to provide the feature and disclose it to the customer that owns the experience. If voice or text AI features are enabled, we may process prompts, transcripts, audio, responses, scene context, and related safety or quality signals.

2.5 Information From Other Sources

We may receive information from an organization that provides your Account; identity or single-sign-on providers; payment processors; cloud and security providers; customer relationship and marketing platforms; integrations you authorize; resellers or referral partners; public business sources; and professional advisers. We combine it with other information only as permitted by law.

• Provide, operate, convert, host, stream, render, personalize, and support the Service and customer-published experiences;
• Create and manage Accounts, organizations, permissions, domains, subscriptions, payments, credits, and Orders;
• Process Customer Content and prompts to create Generated Output and provide AI features requested by the user or customer;
• Authenticate users, secure Accounts and infrastructure, detect fraud, malware, abuse, copyright infringement, and violations, and investigate incidents;
• Measure reliability, compatibility, performance, feature use, and capacity; debug errors; and improve the Service;
• Communicate about transactions, service changes, security, support, renewals, legal terms, and customer requests;
• Provide product updates, events, and marketing where permitted, and honor opt-outs;
• Comply with law, court orders, sanctions, tax and accounting requirements, and enforce agreements;
• Protect the rights, safety, property, and integrity of Moshpit, customers, Viewers, providers, and the public; and
• Create de-identified or aggregated information and use it for lawful analytics, security, research, and business planning, provided we do not attempt to re-identify it.

Where the GDPR, UK GDPR, or similar law requires a legal basis, we rely on the following, depending on context:

• Contract: Provide accounts, conversions, hosting, AI features, support, billing, and requested functionality.
• Legitimate interests: Security, fraud prevention, service analytics, reliability, business administration, and B2B product improvement, balanced against individual rights.
• Consent: Non-essential cookies, optional marketing, optional content/model-training programs, or other activities where consent is required. Consent may be withdrawn prospectively.
• Legal obligations: Tax, accounting, sanctions, lawful requests, and regulatory obligations.
• Vital interests: Emergency protection of life or physical safety.

Where we rely on legitimate interests, those interests include operating a secure and useful B2B technology service, preventing abuse, understanding performance, improving workflows, communicating with business users, and protecting legal rights. You may object where applicable.

5.1 Requested AI Features. When you use an AI feature, Moshpit and authorized model providers may process prompts, Customer Content, scene context, transcripts, and output to generate the requested response, prevent abuse, and maintain the feature. Provider identities and locations should be listed in Moshpit's current subprocessor list.

5.2 No Generalized Training Without Opt-In. Moshpit will not use non-public Customer Content or Generated Output to train generalized AI or machine-learning models unless the customer affirmatively opts in or a separate written agreement expressly permits it. Moshpit will contractually restrict providers from using such content for their own generalized training where the feature and provider support that restriction.

5.3 Operational Improvement. We may use de-identified or aggregated telemetry, error signals, and performance measurements that do not reveal Customer Content or identify a person to improve security, capacity, quality, and compatibility.

5.4 Human Review. Authorized personnel may review limited content when requested for support, when needed to investigate abuse or security, or when a customer has opted into a documented quality-improvement program, subject to access controls and confidentiality.

We may disclose personal information to the following categories of recipients for the purposes described in this Policy:

• Cloud hosting, storage, database, content-delivery, rendering, conversion, monitoring, and infrastructure providers;
• Identity, authentication, collaboration, communications, customer-support, and email providers;
• Payment processors, billing providers, tax providers, accountants, and auditors;
• Security, fraud-prevention, abuse-detection, logging, and incident-response providers;
• Analytics and product-measurement providers, subject to cookie choices and applicable law;
• Artificial-intelligence and machine-learning providers used to deliver enabled AI features;
• Professional advisers, insurers, banks, investors, and auditors under appropriate duties of confidentiality;
• The customer organization that controls an Account or hosted experience, including its administrators, collaborators, and recipients selected through sharing settings;
• Third-party integrations you or your organization enable;
• The public or link recipients when a customer makes an experience, profile, output, or link public or accessible to them;
• A buyer, investor, lender, affiliate, or successor in connection with a financing, merger, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality and notice where required; and
• Law enforcement, regulators, courts, rights holders, or other parties when reasonably necessary to comply with law, protect rights and safety, investigate fraud or abuse, respond to valid legal process, or enforce agreements.

Service providers may process personal information only for contracted services and under confidentiality and data-protection obligations appropriate to the information and risk.

This section supplements the Policy for residents of U.S. states with comprehensive privacy laws. The categories below describe information we may have collected and disclosed for business purposes during the preceding 12 months. Actual collection depends on use of the Service.

We do not knowingly sell personal information for monetary consideration. As of the Effective Date, we do not share personal information for cross-context behavioral advertising or process it for targeted advertising as those terms are defined under applicable U.S. state laws. We do not knowingly sell or share personal information of individuals under 16.

We may disclose the categories above to service providers or contractors for business purposes, to a customer's organization, at the user's direction, in a business transaction, or for legal and security reasons. We do not use or disclose sensitive personal information to infer characteristics about a person beyond permitted purposes.

Depending on where you live, you may have rights to access, know, correct, delete, restrict or object to processing, obtain a portable copy, withdraw consent, opt out of sale, sharing, targeted advertising or certain profiling, and appeal a denied request. You may also have the right not to receive discriminatory treatment for exercising a right.

Submit a request to help@unrealtwin.com. We will verify requests using information reasonably related to the Account or interaction. We may request additional information, deny or limit a request where permitted, and retain a record of the request. Authorized agents must provide proof of authority, and we may verify the request directly with the individual.

To appeal a denied request, reply to our decision with “Privacy Appeal” in the subject line or use the method stated in the decision. You may contact the relevant regulator or attorney general if an appeal is denied, as applicable.

Account settings may permit direct access, correction, export, or deletion. Marketing emails include an unsubscribe mechanism; we may still send transactional, security, and legal messages.

We and our providers may use cookies, local storage, pixels, SDKs, and similar technologies for authentication, security, load balancing, preferences, performance, analytics, support, and — only if implemented and lawfully enabled — advertising.

Essential technologies are required to provide requested functions. Where required, we request consent before using non-essential analytics or advertising technologies. You can manage preferences through your browser or device settings. Blocking technologies may impair features.

Where legally required and technically supported, we treat a recognized Global Privacy Control signal as a request to opt out of sale, sharing, or targeted advertising for the browser or device sending it. Because “Do Not Track” is not standardized, the Service may not respond to DNT signals.

We retain personal information only for as long as reasonably necessary for the purposes described, including service delivery, security, dispute resolution, legal compliance, and enforcement.

• Customer Content and Generated Output: While the Account or project is active; ordinarily removed from active systems within 30 days after user deletion or termination and from routine backups within 90 days, subject to legal holds, security, and customer instructions.
• Account and workspace records: Duration of the relationship plus 3 years, unless a longer period is needed for claims, fraud prevention, or law.
• Billing, tax, and transaction records: 7 years or the period required by applicable tax and accounting law.
• Security, access, API, and diagnostic logs: Typically 12 to 24 months, longer for a documented incident, legal hold, or fraud investigation.
• Support and business communications: Typically 3 years after closure, longer if tied to an active contract or dispute.
• Marketing contacts: Until opt-out or inactivity under the applicable retention rule; minimal suppression records retained to honor opt-outs.
• Privacy requests and consent records: As required to demonstrate compliance, typically 3 to 7 years.

Deletion may take time to propagate through caches, disaster-recovery copies, and provider backups. We may retain de-identified information that cannot reasonably identify a person. A customer may impose different documented retention instructions through an enterprise agreement or Data Processing Addendum.

We use commercially reasonable administrative, technical, and organizational safeguards designed to protect personal information, which may include access controls, encryption in transit, logging, least-privilege practices, secure development, vendor review, backups, and incident procedures. Security measures vary by data, feature, and plan. No system is completely secure, and we cannot guarantee absolute security.

Protect credentials and API keys, use multi-factor authentication where available, limit collaborator access, avoid public links for sensitive content, and contact help@unrealtwin.com promptly if you suspect unauthorized access.

Moshpit is based in the United States, and personal information may be processed in the United States and other countries where Moshpit or its providers operate. Those countries may have different data-protection laws.

Where required, we use recognized transfer safeguards, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, adequacy decisions, or another lawful mechanism, together with supplementary measures where appropriate. Business customers may request the applicable Data Processing Addendum.

Individuals in the EEA, United Kingdom, and Switzerland may have rights to access, rectify, erase, restrict, port, and object to processing; withdraw consent; and lodge a complaint with a supervisory authority. Withdrawal does not affect prior lawful processing. Some rights are subject to exceptions.

Moshpit's legal bases are listed in Section 4.

A customer may use UnrealTwin to publish an experience, collect a lead, embed a viewer, enable an AI concierge, or invite collaborators. In those cases, the customer may be independently responsible for personal information and may have its own privacy policy. Moshpit processes the information to provide the feature and may disclose it to that customer according to the customer's configuration.

If you want to exercise rights regarding personal information inside a particular customer experience, contact the customer first. If you contact Moshpit, provide the experience link and customer name; we may refer the request to the customer unless law requires us to respond directly.

The Service may process images, video, audio, and 3D content that depicts faces or voices, but Moshpit does not use that content to uniquely identify a person or create biometric identifiers unless a separate feature, notice, consent process, and written agreement expressly provides otherwise. Do not use the Service for face recognition, voiceprint identification, emotion inference, or other regulated biometric processing without Moshpit's written authorization and all legally required consent.

Do not submit sensitive or regulated information prohibited by the Terms of Service. If Customer Content incidentally contains such information, use minimization and appropriate access controls.

Accounts are limited to persons at least 18 years old. The Service is not directed to children under 13, and we do not knowingly collect personal information directly from children under 13. Customers must not use the Service to collect children's personal information without Moshpit's prior written authorization and a legally compliant process. If you believe a child provided information, contact help@unrealtwin.com.

Moshpit does not use personal information to make solely automated decisions that produce legal or similarly significant effects about individuals on Moshpit's behalf. AI features may generate recommendations or lead classifications for customers, but customers must review outputs and are prohibited by the Terms from using the Service as the sole basis for high-impact decisions unless expressly authorized and lawful.

The Service may link to or integrate with third-party services. Their privacy practices are governed by their own policies. Review permissions before enabling an integration. Moshpit is not responsible for a third party's independent processing.

We may update this Policy to reflect changes in law, technology, products, providers, or practices. We will post the updated version and change the date above. If changes materially affect how we use previously collected personal information, we will provide additional notice and seek consent where required before the new use begins.

Moshpit XR, LLC

UnrealTwin Privacy

Privacy requests and questions: help@unrealtwin.com

General support: help@unrealtwin.com