Privacy Policy
Last updated: 7 October 2026
This policy explains what personal information Telosolid collects when you use telosolid.com, why, who we share it with, how long we keep it, and the rights you have over it.
1. Who we are
Telosolid is operated by Prosense Limited, Auckland, New Zealand (“Telosolid”, “we”, “us”). Prosense Limited is the controller of your personal information: we decide why and how it is used.
Privacy questions and requests: support@telosolid.com, or through telosolid.com/contact.
We follow the New Zealand Privacy Act 2020. If you are in the European Economic Area (EEA), the United Kingdom or Switzerland, the EU General Data Protection Regulation, the UK GDPR or the Swiss Federal Act on Data Protection also apply, and this policy sets out what they require us to tell you.
We do not sell your personal information, and we do not share your designs, prompts or account details with anyone except the service providers listed in section 8.
2. What we collect
- Account data: username, email address, password (stored only as a one-way hash), and, if you sign in with Google, your Google account identifier.
- Design data: chat messages, images you upload, generated designs, session history, and the model files and drawings you build or upload.
- Usage data: design allowance consumption, AI usage counts, builds and downloads, and their timestamps.
- Billing data: your plan, subscription status and Stripe customer identifier. Card details go directly to Stripe; we never see or store full card numbers.
- Sign-in records: when you sign up or sign in we record your IP address, browser type and a random browser identifier (kept in a cookie that contains nothing else). See section 6.
- Country: the country your account was last used from, worked out from your IP address with the same location database we use for cookie choices (section 5). We keep the country, not the address, and update it at most once a day.
- Shared links: if you share a design, the link, when you made it, and how many times it was viewed, downloaded and led to a new account. If you create an account through someone else's shared link, we note that your account came from a shared link (section 8).
- Support and contact: your name, company, email address and message when you contact us.
- Cookie and email choices: what you chose in Cookie settings, and whether you agreed to product emails, with the date.
- Advertising reference: if you reach Telosolid through one of our ads, a random reference stored in a cookie for 30 days. It contains nothing else and is not linked to you unless you create an account while it is set, in which case we keep it with your account. See section 7.
- Analytics: if analytics is allowed (see section 5), pages visited and how the app is used, through Google Analytics.
3. Why we use it, and our lawful basis
The GDPR requires a lawful basis for each use of personal information. Ours are:
| Purpose | Lawful basis |
|---|---|
| Providing the service: your account, generating and building designs, storing your files, subscriptions and billing | Contract: we need it to provide what you signed up for |
| Account, verification, security and billing emails, and notices of changes to our terms or this policy | Contract |
| Keeping accounts secure, preventing fraud and duplicate free accounts, keeping the service reliable (sign-in records, security logs) | Legitimate interests: protecting the service and its users (section 6) |
| Knowing which country's rules apply to your account (for example, whether marketing email needs your opt-in first) and understanding where our customers are (your account's country) | Legitimate interests: applying the right rules to you, and running the business |
| Shared links you create: showing your design to the people you send the link to | Contract: you asked us to |
| Counting a shared link's views, downloads and sign-ups, and noting that an account came from a shared link | Legitimate interests: showing you how your link is used, and understanding how people find Telosolid |
| Answering support and contact requests | Legitimate interests: responding to you |
| Product news and tips by email | Consent: only if you opt in, and you can withdraw at any time |
| Analytics and advertising measurement for visitors in the EEA, the UK and Switzerland | Consent, given or refused in Cookie settings |
| Analytics and advertising measurement for other visitors | Legitimate interests: understanding whether the site and our advertising work. You can turn both off in Cookie settings |
| Keeping invoices and tax records | Legal obligation (New Zealand tax law) |
4. AI processing
To generate designs, your prompts and related context are sent to our AI provider, Google, solely to produce results for your session. We do not authorise providers to use your content to train public models for unrelated purposes. Prompts and outputs stay with your account under our control.
5. Cookies and similar technologies
Visitors from the EEA, the UK and Switzerland are asked before any analytics or advertising cookie is set, and nothing optional loads until they choose. We work out where a visit comes from by looking up its IP address in a location database held on our own servers (IP Geolocation by DB-IP); the address is not sent anywhere to do this. If we cannot tell where you are, we ask. Visitors elsewhere are given this notice instead of a banner.
Everyone can change their choice at any time in Cookie settings, which is linked at the bottom of every page and in the account menu. Turning advertising off deletes the advertising cookie straight away.
| Name | Purpose | Lasts | Category |
|---|---|---|---|
aethercad_token | Keeps you signed in | 7 days | Strictly necessary |
aethercad_oauth_state, aethercad_oauth_marketing | Protect Google sign-in against forgery, and carry your product-email choice through it | 10 minutes | Strictly necessary |
ts_did | Random browser identifier for duplicate-account detection (section 6). Set only when you sign up or sign in | 90 days, renewed at sign-in | Strictly necessary (security) |
tl_consent | Remembers your cookie choice | 12 months | Strictly necessary |
tl_share, tl_share_pending | Remember the shared design you clicked Sign up or Sign in on, so you go straight back to it. Set only when you click one of those | 7 days, deleted when you return | Strictly necessary |
| Browser storage: theme, measurement unit, current design session | Remembers preferences you set | Until you clear them | Strictly necessary |
_ga, _ga_* | Google Analytics: which pages are visited and how the app is used | Up to 2 years | Analytics |
tl_ref | Remembers which of our ads brought you here (section 7) | 30 days | Advertising |
On the sign-up form, a Cloudflare check confirms that you are not a bot. Fonts and all other files are served from our own domain.
6. Duplicate-account detection
To protect the free tier, when you sign up or sign in we record your IP address, browser type and a random browser identifier, and compare them with other accounts' sign-ins to spot one person opening many free accounts. These sign-in records are deleted after 90 days. The detection is observe-only: it flags possible duplicates for a person to review and never blocks, suspends or decides anything about your account automatically. Staff accounts are never treated as evidence against a customer.
For the same reason, if you delete your account we keep, until your monthly allowance would have reset, a one-way coded form of your email address (it cannot be turned back into the address) and how much of the allowance you had used. If you sign up again with the same address within that time, the new account starts where the old one left off.
7. Advertising
We advertise Telosolid with Google Ads. We do not currently show ads in the EEA, the UK or Switzerland.
If you reach Telosolid through one of our ads, we store a random advertising reference in a cookie for 30 days (for visitors in the EEA, the UK and Switzerland, only if you accept advertising cookies). For an account created through one of our ads, we record when it completes its first design, downloads its first file, and starts a paid subscription, and tell Google Ads that the ad led to a download or a subscription (with the subscription amount). Only the advertising reference, the event and its time are used — never your name, email address, designs or prompts.
If you turn advertising off in Cookie settings while signed in, or delete your account, we delete our advertising records for your reference and ask our marketing system to delete its own. Conversions already reported to Google Ads cannot be recalled; they are held by Google under its own terms.
8. Who we share it with
These service providers process personal information for us, on our instructions:
| Provider | What for |
|---|---|
| Google (Google LLC, part of Alphabet Inc.) | Cloud hosting, database, file storage and service logs; AI processing for design generation (section 4); our advertising landing pages; site analytics, where allowed (section 5); and measuring our advertising (section 7) |
| Stripe | Payments and subscriptions |
| Resend | Sending email |
| Cloudflare | The bot check on sign-up |
We may also disclose information where the law requires it, or to protect the rights and safety of our users or others.
9. International transfers
We are based in New Zealand, which the European Commission and the UK recognise as providing adequate protection for personal data. Our providers process data in other countries, mainly the United States. Where personal information from the EEA, the UK or Switzerland is transferred to a country without such recognition, we rely on the provider's Standard Contractual Clauses (with the UK addendum where it applies) or its certification under the EU–US Data Privacy Framework and its UK and Swiss extensions.
10. How long we keep it
| Information | Kept for |
|---|---|
| Account, designs, files and chat history | Until you delete your account (you can do this yourself, section 11) |
| Sign-in records (IP address, browser, browser identifier) | 90 days |
| Your account's country | Until you delete your account; updated at most once a day |
| Cookie choices recorded with your account | Until you delete your account |
| Usage records (how much of your allowance you used) | Kept for accounting; when you delete your account they are no longer linked to you |
| After you delete your account: a one-way coded form of your email address and how much of this month's design allowance you had used | Until the date your allowance would have reset (at most about a month), so that deleting and re-creating an account does not reset it. Deleted as soon as it is used |
| Invoices and payment records (held by Stripe) | 7 years, as New Zealand tax law requires |
| Shared links you made, and their counts | Until you turn the link off, or delete the design or your account. The link's preview picture is deleted when the link is turned off |
| That your account came from a shared link | Until you delete your account |
| Advertising reference and its events | Until you delete your account or turn advertising off; the cookie itself lasts 30 days |
| Service logs | Up to 30 days |
| Database backups | 7 days, then overwritten. If we ever restore one, we delete again any account deleted since it was taken |
| Support emails | As long as needed to resolve the request; deleted on request |
11. Your rights
You have the right to:
- Access your information and receive a copy — use Download my data in the account menu, which also gives it to you in a portable format (portability);
- Correct inaccurate information;
- Erase your information — use Delete Account in the account menu. This deletes your account, designs and files, cancels any subscription, and asks our marketing system to delete its records, apart from what the law requires us to keep (section 10);
- Restrict or object to how we use your information, including where we rely on legitimate interests;
- Withdraw consent at any time, without affecting what happened before: through Cookie settings, the Product emails switch in the account menu, or the unsubscribe link in any product email;
- Not be subject to decisions based solely on automated processing that significantly affect you. We make none (section 6).
For anything you cannot do in the app, email support@telosolid.com. We will answer within one month, and may ask you to confirm your identity first.
You can also complain to a regulator: the data protection authority where you live or work in the EEA, the UK Information Commissioner's Office, the Swiss FDPIC, or New Zealand's Office of the Privacy Commissioner. We would appreciate the chance to put things right first.
12. Emails
We send account emails (verification, password resets, security and billing messages, and notices of changes to our terms or this policy) because the service needs them. We send product news and tips only if you opt in, and every one carries an unsubscribe link.
13. Security
We use encryption in transit (HTTPS), access controls, hashed passwords, isolated processing of design builds, and restricted access to production systems. If a breach puts your information at risk, we will notify the relevant regulator and, where required, you.
14. Age
Telosolid is intended for professional and business users aged 16 and over. We do not knowingly collect personal information from children.
15. Changes to this policy
We will post any change on this page with a new date, and tell you by email or in the app before a material change takes effect.
16. Contact us
Prosense Limited, Auckland, New Zealand
Privacy enquiries: support@telosolid.com
Web: telosolid.com/contact