Privacy Policy

This Privacy Policy explains how personal information is handled when you use the Immersive Scenes Website, Immersive Scenes Accounts, Rolltable Manager, and related current services that link to this policy (together, the "Services").

Who is responsible

Immersive Scenes is operated by Frederik Stahlfest, who is the data controller for the processing described in this policy.

What this policy covers

Different parts of Immersive Scenes handle different information.

The public Website is primarily a static content site. Immersive Scenes Accounts provides sign-in and access management. Rolltable Manager is local-first and can be used without an account, with private Cloud Sync available to eligible accounts.

This policy describes the Services and processing that exist now.

Information Immersive Scenes uses and why

The information involved depends on which Services you use.

Where European data-protection law applies, the legal basis depends on the purpose. Processing needed to provide requested account and cloud features is generally necessary to perform the agreement with you. Delivering, maintaining, troubleshooting, and securing the Services, and responding to ordinary inquiries, may rely on legitimate interests where those interests are not overridden by your rights and interests. Optional external media relies on consent. Processing required by law relies on the relevant legal obligation.

Website and service requests

When you visit or use an Immersive Scenes service, hosting and delivery infrastructure may process technical information needed to deliver and protect the service.

This can include information such as your IP address, request time, requested page or endpoint, browser or device information, and similar network, request, or security information.

The Immersive Scenes Website does not run its own analytics or advertising trackers at launch.

Immersive Scenes Accounts

Immersive Scenes Accounts provides authentication and access management for account-linked Services.

Auth0 by Okta is the current identity provider.

When you sign in, Accounts uses the identity information needed to recognize and operate your account. This includes:

• a unique identity-provider identifier;
• your email address and whether it has been verified;
• an internal Immersive Scenes account identifier;
• account status and access or entitlement records;
• limited sign-in and account-activity information needed to operate and secure the account.

The current first-party account model does not use a profile image, date of birth, or general profile/display name.

Accounts uses essential browser storage during sign-in and to maintain your authenticated session. This includes short-lived sign-in transaction information and encrypted session cookies.

An Accounts session can remain valid for up to 30 days without qualifying activity and has a maximum lifetime of 90 days from the sign-in that created the session.

Background Rolltable authorization is handled separately and does not by itself count as user activity.

Accounts stores account and entitlement information in Supabase-backed infrastructure.

Rolltable Manager

Rolltable Manager is local-first.

You can use local features without an Immersive Scenes account. Local projects, application state, selected preferences, and related local data are stored in browser storage on your device.

Creating, opening, editing, saving, or rolling from a project that is kept local-only does not upload that project's authored content to Immersive Scenes.

Cloud Sync is available to eligible accounts.

For an account that includes Cloud Sync, new projects are set up with a private cloud copy by default unless you turn Cloud Sync off when creating the project.

Existing local projects are not uploaded merely because you sign in.

When Cloud Sync is active for a project, Immersive Scenes stores the supported project content and selected project configuration, saved workspace/result information that is part of the supported sync model, synchronization and revision information, and account-linked identifiers needed to maintain the private cloud copy.

Cloud Sync does not upload every local browser preference, local history item, installed reference package, or other device-only application state.

The cloud copy is private storage for the account. It is not a public publishing surface.

Immersive Scenes does not use private project content for advertising, profiling, or unrelated purposes.

If you choose to include personal information about another person in project content, you are responsible for having an appropriate reason, permission, or other lawful basis for doing so.

Information that exists only in local browser storage and was never uploaded cannot be retrieved or deleted server-side by Immersive Scenes.

Messages, support, privacy requests, and legal reports

If you contact Immersive Scenes, the reply address, message, and other information you choose to provide are processed to handle the request.

Google currently provides the mailbox used for Immersive Scenes contact messages.

Immersive Scenes uses message information to understand and respond to the request, provide relevant follow-up, handle support or privacy requests, investigate security or hosted-content reports, and meet legal obligations where applicable.

Do not send passwords, access tokens, or other secrets when contacting Immersive Scenes.

Browser storage and optional external media

Different Services use browser storage for different purposes.

The Website uses browser storage to remember functional preferences, locally cache public Website content, maintain temporary framework/reload state, and remember your optional External media choice.

Rolltable Manager uses IndexedDB and localStorage for local projects, application state, preferences, and related local-first functionality.

Immersive Scenes Accounts uses essential cookies and related browser state for authentication and session handling.

External media preference

The Website remembers both Allow and Reject choices for External media for 12 calendar months from the time you make the choice.

After that period, the choice expires and the Website asks again.

If the purpose or providers covered by that choice materially change, Immersive Scenes may require a new choice sooner by changing the consent version.

You can change or withdraw your choice at any time through Cookie settings in the Website footer.

If your browser cannot save the preference, a choice may apply only to the current loaded Website state and may not survive a reload.

Spotify and YouTube

Spotify and YouTube embedded players are optional external media.

They are blocked until you allow External media. Before that choice, blocked media uses resources served by Immersive Scenes rather than loading the external Spotify or YouTube player.

When you allow an embedded player, your browser connects to that provider. The provider can receive information such as your IP address, browser or request information, and information it stores or accesses under its own privacy practices.

Turning External media off removes loaded optional players and prevents them from loading again while the option remains off.

Withdrawal cannot undo information already sent to a provider, cancel every request already in flight, or remove storage that the provider has already placed in your browser.

Ordinary external links remain available independently of the embedded-player preference.

Terms and Privacy records

Where Rolltable Manager presents the Terms acceptance step, it stores the accepted Terms version and acceptance time locally in your browser.

The Privacy Policy has no separate acceptance version.

Reading this policy or accepting the Terms does not enable optional external media.

Service providers and external services

Immersive Scenes uses service providers where they are needed to operate the current Services.

Current providers include:

• Netlify for Website hosting and delivery;
• Auth0 by Okta for authentication and identity services;
• Supabase for current Accounts and Rolltable cloud/database infrastructure;
• Google for the current Immersive Scenes contact mailbox and YouTube services;
• Spotify when you choose to load optional Spotify media.

Ordinary links on the Website can also take you to external services such as Bandcamp, Spotify, YouTube, Patreon, and social platforms. If you choose to follow an external link or use another provider's service, that provider's own privacy practices apply.

Where information is processed

Core production databases for Immersive Scenes Accounts and Rolltable Manager are hosted in the European Union.

The Auth0 identity environment is configured for its European region.

Some service providers and their subprocessors may process information in other countries, including countries outside the European Economic Area.

Where applicable law requires safeguards for an international transfer, Immersive Scenes relies on appropriate mechanisms available through the relevant service-provider arrangements, such as adequacy decisions or contractual safeguards.

Immersive Scenes does not promise that all information is processed exclusively inside the European Union.

How long information is kept

Retention depends on what the information is used for and where it is stored.

Browser-only information

Information stored only in your browser remains there until the application removes it, you remove it, or your browser or device removes it.

Clearing Rolltable Manager site storage can remove local projects, preferences, and local Terms acceptance information.

Clearing Rolltable Manager browser storage does not by itself delete your Immersive Scenes account or a server-side cloud copy.

Downloaded backups or exports are separate files and are not deleted when browser storage is cleared.

External media preference

The Website treats your Allow or Reject External media choice as valid for 12 calendar months unless a material consent change requires a new choice sooner. After expiry, the saved record may remain in your browser until it is replaced or removed, but the Website no longer uses it as a valid choice.

Accounts

Immersive Scenes keeps account information while it is needed to maintain your account and provide its features.

Accounts that have been inactive for 24 months or more and have no retained Service data or other valid reason for retention may be deleted or anonymized.

This does not mean an account is guaranteed to be removed on the exact 24-month anniversary.

Cloud projects

Cloud-project content is retained while the cloud copy is maintained.

A cloud project is not deleted solely because the account has been inactive.

Support and contact correspondence

Support and contact messages are kept for as long as reasonably necessary to handle the request, provide relevant follow-up, maintain useful support history, or address security, legal, accounting, or dispute-related needs.

Immersive Scenes deletes or anonymizes correspondence when there is no longer a reasonable reason to keep it.

Technical logs and backups

Technical, security, and service logs are kept for limited periods where needed to operate, troubleshoot, and protect the Services.

Some information may remain temporarily in routine backups after it has been deleted from the live service. It is removed as those backups expire or are replaced.

Security

Immersive Scenes uses reasonable technical and organizational safeguards appropriate to the Services.

These include authenticated access controls for private cloud information, secure session handling, short-lived cloud authorization, and current access checks where relevant.

No online service or storage system can guarantee absolute security.

Keep your sign-in method secure and keep your own backups of important local content.

Your privacy rights

Depending on the circumstances and applicable law, you may have rights to access, correct, delete, restrict, or object to the processing of your personal information, and to receive certain information in a portable format.

You can make a privacy request through the Immersive Scenes Contact page.

Immersive Scenes may ask for information reasonably necessary to confirm your identity before acting on a request.

Immersive Scenes responds without undue delay and normally within one month.

If applicable law allows additional time because a request is complex or because a number of requests have been received, Immersive Scenes will tell you within the first month and explain the reason.

Where processing relies on your consent, you can withdraw that consent at any time without affecting processing that was lawful before withdrawal.

You also have the right to complain to the Danish Data Protection Agency (Datatilsynet) or another competent supervisory authority.

Children

Immersive Scenes is intended for a general audience and is not specifically directed at children.

Immersive Scenes does not knowingly process children's personal information in circumstances where applicable law requires parental authorization.

If Immersive Scenes becomes aware of such processing without the required authorization, it will take appropriate steps to comply with the law.

Changes to this policy

The Last updated date at the top of this page identifies the current Privacy Policy.

Immersive Scenes updates this policy when the Services or data-processing practices materially change.

If a new processing purpose requires consent, Immersive Scenes will ask for that consent separately where required rather than treating the Privacy Policy itself as consent.

Updating the Privacy Policy does not by itself mean that you have accepted a new version of the Terms.

Contact

For privacy questions or requests concerning your personal information, use the Immersive Scenes Contact page.

Please include enough information for Immersive Scenes to understand the request, but do not send passwords, access tokens, or other secrets.