Privacy Policy

This Privacy Policy explains how OVER Holding S.r.l. ("OVER", "we", "us") collects, uses, retains, and shares personal data when you use the website freegaussian.ai and the related upload, processing, and download services (collectively, the "Service").

We process personal data in accordance with Regulation (EU) 2016/679 ("GDPR") and the Italian Data Protection Code (D. Lgs. 196/2003 and subsequent amendments).

By using the Service, you confirm that you have read and understood this Privacy Policy. Where the law requires consent (in particular for the Free Tier processing described in Section 5), we will ask for it separately and clearly at the point of upload.

1. Data Controller

The data controller is:

OVER Holding S.r.l.

Viale Tricesimo n. 200, Udine, Italy

Tax Code / VAT no.: IT02945890305

Email: [email protected]

For any privacy-related question, complaint, or to exercise your rights, contact us at the email above.

2. Scope

This Policy applies only to the Service operated at freegaussian.ai (and its subdomains, including app.freegaussian.ai). It does not cover other OVER products such as the OVER app, OVER Marketplace, OVR Tokens, or OVRLands, which are governed by their own privacy policy at overthereality.ai/privacy.

3. What the Service Does

FreeGaussian.ai allows you to upload 360° video footage, which is processed on our infrastructure to reconstruct a 3D Gaussian Splat scene that you can download or embed.

To deliver this Service, we necessarily process the content you upload, account information, and certain technical data.

4. Data We Collect

4.1 Account information

When you sign in or create an account, we collect: email address, authentication identifiers (e.g., OAuth tokens or hashed password), display name, and account preferences.

4.2 Content you upload

We collect the video files (and any associated metadata such as resolution, frame rate, codec, capture date, and embedded GPS coordinates if present) that you upload for processing.

Important: Uploaded video may incidentally contain personal data of third parties, including identifiable faces, voices, license plates, the interior of private spaces, or other identifying features. You are responsible for the lawful basis to upload such content (see Terms & Conditions).

4.3 Generated output

We store the reconstructed Gaussian Splat scenes ("Outputs") generated from your uploads, together with processing logs and quality metrics.

4.4 Technical and usage data

Like most online services, we automatically collect: IP address, browser type and version, device and operating system, pages viewed, timestamps, referring URL, error logs, and similar diagnostic data.

4.5 Cookies

We use strictly necessary cookies for authentication and session management, and limited analytics cookies to understand aggregate usage. We do not use marketing or advertising cookies. You can manage cookies through your browser settings.

5. Free Tier — The Deal (Please Read)

The Free Tier is offered under a barter arrangement: OVER provides the Service to you at no monetary cost, and in exchange, you grant OVER the rights described in this Section and in Section 6 of the Terms & Conditions over the videos you upload (the "Uploads") and the 3D Gaussian Splat scenes reconstructed from them (the "Outputs").

This exchange is the contract between you and OVER for the Free Tier. The rights OVER receives are the consideration for the free compute, storage, and processing we provide to you.

5.1 How OVER uses Free Tier content

OVER will use Free Tier Uploads and Outputs to:

• train, evaluate, fine-tune, and improve OVER's 3D reconstruction, NeRF, and Gaussian Splatting models;
• conduct internal and external research and development on computer vision, photogrammetry, and AR/VR technologies;
• benchmark and quality-assure the Service;
• create derivative datasets (including annotated, processed, aggregated, and de-identified datasets);
• demonstrate OVER's technology in non-commercial and commercial contexts.

5.2 Disclosure and sale to third parties — de-identification

OVER will also license and sell Free Tier content to third parties for their own purposes, including:

• AI and machine-learning companies, for training, evaluating, or benchmarking their own models;
• academic and research institutions, for scientific research;
• AR, VR, spatial-computing, mapping, and 3D-content companies, for product development;
• commercial partners of OVER;
• other recipients that acquire datasets or licenses from OVER under commercial terms.

Before any Free Tier content is shared with or sold to a third party, OVER applies de-identification measures designed to reduce the likelihood of identifying individuals, including:

• automated blurring or removal of detected human faces;
• automated blurring or removal of detected vehicle license plates;
• additional safeguards proportionate to the use case, where appropriate.

De-identification substantially reduces but does not eliminate re-identification risk (for example, other visible features, context, or GPS metadata may remain). OVER imposes contractual obligations on recipients prohibiting attempts to re-identify individuals in the shared data.

The third parties receiving content act as independent data controllers and process it under their own policies and legal bases.

A list of the current categories of recipients, and where feasible the actual recipients, is available on request at [email protected].

5.3 Legal basis

OVER processes Free Tier Uploads and Outputs on the following legal bases:

• Article 6(1)(b) GDPR — performance of a contract: the barter arrangement described above is the contract between you and OVER. Processing the Uploads and Outputs (including for the purposes in Sections 5.1 and 5.2) is necessary to perform that contract, because granting OVER those rights is precisely what you are exchanging for the Service.
• Article 6(1)(f) GDPR — legitimate interests: for the processing of personal data of any third parties incidentally captured in your Uploads (e.g., bystanders). OVER's legitimate interests — advancing 3D reconstruction technology and operating a viable Service — are balanced against the rights of those individuals by the de-identification safeguards described in Section 5.2 and by the obligations imposed on recipients. Individuals appearing in Uploads retain the rights set out in Section 11, including the right to object under Art. 21 GDPR.
• Article 9(2)(a) GDPR — explicit consent: where any special categories of data (e.g., biometric identifiers) are processed, we rely on your explicit consent, obtained separately at the point of upload.

5.4 What this means for you

Because the Free Tier is a contract, not a consent-based arrangement, the rights OVER acquires over the content you submit are part of the exchange and cannot be unilaterally revoked, in the same way you cannot unilaterally revoke any other contract after receiving the benefit of it. In particular:

• processing, dataset creation, training runs, and disclosures to third parties that have already taken place remain lawful;
• derivative datasets, trained model weights, and copies already delivered to recipients are not recalled;
• compute, storage, and engineering effort OVER has invested in your Upload are not reversed.

If you do not want OVER to have these rights over your content, do not use the Free Tier. The Paid Tier (where available) is offered as a separate, monetary-payment contract under which OVER processes your content solely to deliver the Service to you and does not train on, research with, demonstrate, or disclose it to third parties. See https://freegaussian.ai/upload or contact [email protected].

You continue to have the statutory data-protection rights set out in Section 11 (access, rectification, restriction, portability, and — where applicable — objection and erasure). How these rights operate in the Free Tier context is shaped by the fact that OVER's processing is based on performance of a contract (Art. 6(1)(b) GDPR), not on consent:

• The right to object under Art. 21 GDPR does not apply to contract-based processing of your own data. It applies only to OVER's processing of third parties incidentally captured in your Uploads, for which OVER relies on legitimate interests — and is mitigated by the de-identification safeguards in Section 5.2.
• The right to erasure under Art. 17 GDPR is subject to the exceptions listed in Art. 17(3), including where processing is necessary for the performance of a contract, for the establishment, exercise, or defence of legal claims, or where erasure would seriously impair research, statistical, or archiving purposes. Where those exceptions apply, OVER is entitled to refuse erasure.
• The right to restriction under Art. 18 GDPR is a temporary measure that pauses processing during verification of a dispute. It does not compel deletion.
• The rights to access, rectification, and portability do not, by their nature, require OVER to stop using, delete, or recall the content.

Where OVER is nonetheless required by law to act on a request (for example, a valid erasure request falling outside the exceptions above), OVER will:

• stop further internal processing and further external disclosure of the specific Upload and Output going forward;
• remove the source files from active storage, subject to legal-retention obligations and the need to preserve evidence for the defence of legal claims;
• exclude the content from future training runs and future dataset releases.

Because of the nature of the processing and of the barter arrangement, the following are not reversed or recalled when a right is exercised, and OVER does not undertake to do so:

• processing, training, dataset creation, or disclosure to third parties that has already taken place;
• copies already delivered to or acquired by third parties (OVER will, however, notify recipients where the relevant contract requires or permits it);
• contributions already incorporated into trained model weights, derived insights, or already-distributed de-identified datasets, as removal is not technically feasible and is not required by GDPR;
• compute, storage, and engineering effort OVER has invested in the Upload.

Nothing in this Section limits the mandatory rights you have under GDPR. If you believe your rights have not been respected, you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or your local supervisory authority.

6. Legal Basis for Processing

7. How Long We Retain Data

8. Sharing With Third Parties

We share data with the following categories of recipients:

• Cloud and compute providers that host the Service and run the reconstruction pipeline. These are sub-processors acting on OVER's instructions under a data-processing agreement. A current list is available on request at [email protected].
• Authentication providers, if you sign in with a third-party identity (e.g., Google).
• Authorities, where required by law, court order, or to protect our rights or those of our users.
• Affiliated companies within the OVER group, on the same terms as set out in this Policy.
• Commercial recipients of Free Tier data — including AI/ML companies, research institutions, AR/VR and 3D-content companies, and other commercial partners — who acquire Free Tier Uploads, Outputs, or derivative datasets from OVER under licenses or purchase agreements. Before sharing, OVER applies the de-identification measures described in Section 5.2, and recipients are contractually prohibited from attempting re-identification. These recipients act as independent controllers. This disclosure applies only to Free Tier content and is the consideration for the barter arrangement described in Section 5.

We do not sell or license Paid Tier content to third parties for their own purposes.

We do not share personal data with third parties for their direct marketing purposes.

9. International Data Transfers

We aim to host and process data within the European Economic Area. Where transfers outside the EEA are necessary (for example, to a cloud provider's region), we rely on Standard Contractual Clauses approved by the European Commission and apply additional safeguards as required by Articles 44–49 GDPR.

10. Security

We apply technical and organizational measures appropriate to the risk, including encryption in transit, access controls, and separation of duties. No system is perfectly secure; we encourage you not to upload footage you would not be comfortable with us holding.

11. Your Rights

Under GDPR, you have the right to:

• Access your personal data and obtain a copy;
• Rectify inaccurate or incomplete data;
• Erase your data ("right to be forgotten"), subject to limitations described in Section 5 regarding trained models;
• Restrict or object to certain processing;
• Withdraw consent at any time, where processing is based on consent;
• Portability — receive your data in a structured, machine-readable format;
• Lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or your local supervisory authority.

To exercise these rights, email [email protected]. We will respond within one month, extendable by two further months for complex requests.

12. Third-Party Personal Data in Your Uploads

If your uploaded video contains identifiable persons or other third-party personal data:

• You confirm you have the legal right to upload it (consent of those depicted, or another lawful basis);
• You are responsible, as an independent controller, for informing those individuals about the processing;
• We will respond to deletion requests from third parties identifiable in uploads; please contact [email protected] with sufficient information to identify the relevant content.

13. Children

The Service is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact [email protected] and we will delete it.

You should also not upload video featuring identifiable children unless you have the consent of their parent or legal guardian.

14. Changes to This Policy

We may update this Policy. Material changes — in particular changes to how Free Tier data is used — will be notified by email and/or in-app notice before they take effect, with a renewed opportunity to withdraw consent.