Legal
Privacy Policy
Last updated: 15 July 2026. This policy covers the Site Vision AR website at sitevisionar.com, the customer portal, and the Site Vision AR application for Meta Quest headsets.
1. Who we are
Site Vision AR is a service operated by Mattacode Studio (“we”, “us”, “our”). We turn architectural drawings and 3D plans into augmented and virtual reality models that our customers can walk through at full scale.
We are the data controller for the personal data described in this policy. If you have any question about this policy, or want to exercise any of the rights described in it, contact us at hello@sitevisionar.com.
2. What data we collect
We only collect what we need to run your account and deliver your models. We do not buy personal data from anyone else, and we do not collect data about you when you are not using our website or app.
Data you give us
| Data | When we get it |
|---|---|
| Email address | When you apply for an account, or when you email us about a project. |
| Name / display name | When you apply for an account. Shown to you in the portal and in the headset. |
| Username | Chosen by you at signup. It is your login ID for both the portal and the headset. |
| Password and headset PIN | Chosen by you. Stored only as a salted scrypt hash — we never hold your password in readable form and cannot recover it, only reset it. |
| Your project files | The 3D models, drawings and textures you (or we, on your behalf) upload to your account. |
| Project names and notes | Any label or note you add to a project, and anything you choose to include in a signup application. |
Data created by using the service
| Data | Why it exists |
|---|---|
| Login session cookie | A signed cookie named sv_session that keeps you logged in to the portal for up to 7 days. It contains your username and an expiry, signed so it cannot be tampered with. It is strictly necessary — it is not used for tracking or advertising. |
| Download and credit counts | How many model loads your account has used and how many credits remain, so metered accounts are billed correctly. |
| Billing status | Your Stripe customer and subscription identifiers and your subscription status (for example 'active'), so we know what your account is entitled to. |
| Account creation date | Recorded when your account is created, for our own records and support. |
| Server logs | Our hosting provider records standard technical logs of requests to the site, including IP address, time and user agent. These are used to keep the service running and secure. |
What the headset app collects
The Site Vision AR app for Meta Quest stores your username and PIN on the headset itself, in the app's private storage, so that you only have to log in once per headset. It sends those credentials to our servers over an encrypted HTTPS connection to log you in, to check whether your account can download a model, and to fetch your own project files. Signing out of the app deletes those stored credentials from the headset.
The app does not collect, store or transmit any of the following:
- Camera images, passthrough video, or any picture of your surroundings.
- Head, hand, eye, face or body tracking data, room scans, boundary or spatial-mapping data.
- Microphone audio or voice recordings.
- Your location.
- Your Meta account details, friends, or profile information.
- Advertising identifiers, or any analytics about how you move around inside a model.
Sensor data of that kind stays on the headset and is used by the device only to draw the scene in front of you. It never reaches us.
3. Why we use it, and our legal basis
Under the UK GDPR we must have a lawful basis for using your personal data. Ours are set out below.
| Purpose | Legal basis |
|---|---|
| Creating your account and logging you in, on the website and in the headset. | Performance of our contract with you. |
| Storing your project files and delivering them to your headset. | Performance of our contract with you. |
| Taking payment, managing subscriptions, and metering download credits. | Performance of our contract with you, and our legal obligation to keep accurate financial records. |
| Emailing you about your account, your projects, or a signup application. | Performance of our contract with you, or our legitimate interest in responding to your enquiry. |
| Reviewing signup applications and deciding whether to approve them. | Our legitimate interest in deciding who we do business with, and in preventing abuse. |
| Keeping the service secure, available and free from abuse. | Our legitimate interest in protecting the service and our customers. |
We do not use your data for advertising, we do not profile you, and we do not sell or rent your personal data to anyone. There is no third-party analytics, tracking pixel or advertising SDK in our website or in our headset app.
5. How long we keep it
We keep your account details and your project files for as long as your account is open, because that is the service: your models need to be there when you put the headset on.
If you close your account, or ask us to delete it, we delete your account record and your project files within 30 days. Pending signup applications that we reject are deleted once the decision is made. Records we are legally required to keep — chiefly financial records of payments, which UK law requires us to retain for six years — are kept for that period and then deleted. Technical server logs are held only briefly by our hosting provider, in line with their standard retention.
6. How we protect it
All traffic to our website, our API and the headset app runs over encrypted HTTPS connections. Passwords and PINs are stored only as salted scrypt hashes, never in readable form. Login sessions are protected with a signed cookie that cannot be forged or altered on the client. Access to your project files requires a valid login, and access to our administrative tools is restricted to us. Payment card details are handled entirely by Stripe, a PCI-DSS certified provider, and never touch our systems.
No system can be guaranteed perfectly secure, but if a breach ever affects your personal data we will notify you and the Information Commissioner's Office as the law requires.
7. Your rights
Under UK and EU data protection law you have the right to ask us to:
- Give you a copy of the personal data we hold about you.
- Correct it if it is wrong or incomplete. You can change your display name and password yourself in the portal at any time.
- Delete it, and close your account, where we have no overriding legal reason to keep it.
- Restrict or object to our use of it, including where we rely on legitimate interests.
- Port it — receive it in a portable format, or have it sent to another provider.
To exercise any of these, email hello@sitevisionar.com. We will respond within one month, and we will not charge you. You do not need an account to make a request, and you do not have to give us any new data to see this policy.
If you are unhappy with how we have handled your data you can complain to the UK Information Commissioner's Office at ico.org.uk, or to your local supervisory authority.
8. Children
Site Vision AR is a professional tool for architects, builders, developers and their clients. It is not directed at children, and we do not knowingly collect personal data from anyone under 13. If you believe a child has given us personal data, contact us and we will delete it.
9. Changes to this policy
If we change this policy we will update the date at the top of this page. If a change materially affects how we use your personal data, we will tell you by email before it takes effect.
10. Contact us
For any privacy question, data request or complaint:
Site Vision AR — Mattacode Studio
hello@sitevisionar.com