Privacy Policy

•  Technical and usage data: IP address, browser and device type, pages visited, and log data needed to run and secure the website.

•  Gallery data: the number of likes of each world. Your own likes are remembered only in your browser (local storage), not in your account.

3. Why we use it and on what legal basis

•  To provide the Service: create your account, build, publish and manage your worlds, and handle plans and packs. Basis: performance of the contract (Art. 6(1)(b) GDPR).

•  To take payments, issue invoices and keep accounting records. Basis: contract and legal obligation (Art. 6(1)(b) and (c)).

•  To answer your messages and handle withdrawals, complaints and content reports. Basis: contract and legal obligations under consumer law and the Digital Services Act (Art. 6(1)(b) and (c)).

•  To keep the Service secure, prevent fraud and abuse (for example several free trials for one person), and moderate content. Basis: our legitimate interests (Art. 6(1)(f)).

•  To send service emails about your account, worlds and subscription. Basis: contract (Art. 6(1)(b)).

•  To send newsletters and offers, only if you agreed. Basis: consent (Art. 6(1)(a)). You can withdraw consent at any time through the link in each email.

•  To measure how the website is used with analytics cookies, only if you accept them. Basis: consent (Art. 6(1)(a)).

4. AI processing of your photos

To build your world, your photos are sent to AI 3D-generation services that create 3D objects from them. These services process the photos on our behalf to deliver the Service. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

5. Who receives your data

We share personal data only when needed, with:

•  Wix.com Ltd and its group, which host the website, member accounts, databases and payments (Israel, the EU and the United States);

•  payment providers shown at checkout, such as Wix Payments, to process your payments;

•  AI 3D-generation and cloud computing providers that build your world on our behalf (located in the EU or the United States);

•  Decentraland, where your world is published. A published world, with its name, images and 3D content, is public and can be seen by anyone;

•  authorities, courts or advisers, when the law requires it or to defend legal claims.

Our service providers act as processors under a data processing agreement, except Decentraland and payment providers where they act as independent controllers.

6. Transfers outside the EU

Some providers are located outside the European Economic Area. Transfers to Israel rely on the European Commission’s adequacy decision. Transfers to the United States rely on the EU–US Data Privacy Framework where the provider is certified, or otherwise on the European Commission’s Standard Contractual Clauses. You can ask us for a copy of the safeguards.

7. Public worlds

When you publish a world, its content is deployed to Decentraland’s decentralised content servers, which may be copied by third-party nodes. We unpublish your world and remove it from our gallery when you delete it or close your account, but we cannot guarantee that copies kept by third parties are deleted. Do not include personal information you do not want to make public.

8. How long we keep data

•  Account data: while your account is open, and deleted within 24 months after your last activity or after you close the account.

•  Worlds and photos: while your plan is active. Trial worlds are deleted 30 days after they expire. Paid worlds that go offline are deleted 90 days after the plan ends.

•  Invoices and accounting records: 7 years, as required by the Estonian Accounting Act.

•  Support, withdrawal and complaint records: 3 years, the general limitation period for claims.

•  Server and security logs: up to 12 months.

9. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw any consent you gave. To use these rights, write to contact@metarivers.com. We answer within one month.

You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee, or to the data protection authority of the EU country where you live or work.

10. Children

The Service is not intended for children under 16 and we do not knowingly collect their data. If you believe a child has given us personal data, please contact us and we will delete it.

11. Security

We use technical and organisational measures to protect your data, including encrypted connections (HTTPS), access controls and reputable hosting providers. No system is completely secure, so we also ask you to keep your login details safe.