Privacy Policy

Last updated: March 18, 2026

1. Introduction

Spline, Inc. ("Spline", "we", "us", or "our") operates the Omma platform at omma.build (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with the practices described herein, please do not use the Service.

2. Information We Collect

Account Information: When you create an account, we collect your name, email address, and profile picture through your OAuth provider (such as Google). We may also collect information you provide when updating your profile or contacting support.

User Content: We store the content you create using the Service, including chat conversations, AI prompts, generated code, images, 3D models, uploaded files, and published projects.

Usage Data: We automatically collect information about how you interact with the Service, including pages visited, features used, credit consumption, session duration, click patterns, and performance metrics.

Device and Technical Information: We collect information about the device and browser you use to access the Service, including device type, operating system, browser type, screen resolution, IP address, and general location data derived from your IP address.

Payment Information: If you subscribe to a paid plan, payment information is collected and processed by our third-party payment processor (Stripe). We do not directly store your full credit card number or banking details.

3. How We Use Your Information

We use the information we collect to:

  • Provide, operate, maintain, and improve the Service
  • Process transactions, manage your subscription, and track credit usage
  • Send you technical notices, security alerts, and support messages
  • Monitor and analyze usage trends to improve user experience and Service performance
  • Detect, prevent, and address fraud, abuse, and technical issues
  • Enforce our Terms of Service and protect the rights, property, and safety of Spline, Inc. and our users
  • Comply with legal obligations and respond to lawful requests from public authorities

4. AI Processing and Third-Party AI Providers

When you use AI features, your prompts, uploaded images, and relevant context are sent to third-party AI providers for processing. These providers currently include:

  • Anthropic for Claude-powered code generation, chat, and analysis
  • Google for Gemini-powered code generation and embeddings
  • OpenAI for GPT-powered code generation and chat
  • fal.ai for image generation and 3D model generation

These providers process your data according to their own privacy policies and terms. We do not use your prompts, conversations, or generated content to train AI models. We recommend reviewing the privacy policies of these providers to understand how they handle your data.

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following limited circumstances:

  • Service Providers: With trusted third parties who assist in operating the Service, including cloud hosting (Vercel, Supabase), payment processing (Stripe), AI processing (as described above), analytics (Amplitude), and infrastructure services (Fly.io)
  • Community Content: Content you choose to publish to the community is visible to other users. Your profile name and avatar are displayed alongside published content
  • Legal Requirements: When required by law, regulation, legal process, or governmental request
  • Protection of Rights: When necessary to protect the rights, property, or safety of Spline, Inc., our users, or the public
  • Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change

6. Data Retention

We retain your account information and content for as long as your account is active or as needed to provide the Service. Deleted projects are soft-deleted and may remain in our systems for up to 30 days before permanent deletion. You may delete your account and request deletion of your associated data at any time by contacting support@omma.build.

Some data may be retained in encrypted backups for a limited period after deletion. We may also retain certain information as required by law or for legitimate business purposes such as fraud prevention and resolving disputes.

7. Data Security

We implement industry-standard technical and organizational security measures to protect your data, including:

  • Encryption in transit (TLS/HTTPS) and at rest
  • Access controls and authentication for all internal systems
  • Regular security reviews of our infrastructure and code
  • Row-level security policies on our database to ensure data isolation between users

However, no method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee its absolute security. If you become aware of a security vulnerability, please report it to security@omma.build.

8. Cookies and Tracking Technologies

Essential Cookies: We use essential cookies to maintain your session, authentication state, and user preferences. These are necessary for the Service to function properly.

Analytics: We use Amplitude for product analytics to understand how users interact with the Service and to improve the user experience. Amplitude may use cookies or similar technologies to collect usage data.

No Advertising Cookies: We do not use third-party advertising or behavioral tracking cookies.

9. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

  • Access: Request a copy of the personal information we hold about you
  • Correction: Request correction of inaccurate or incomplete personal information
  • Deletion: Request deletion of your personal information, subject to certain legal exceptions
  • Portability: Request a portable copy of your data in a structured, commonly used format
  • Objection: Object to or restrict processing of your data in certain circumstances
  • Withdraw Consent: Where processing is based on consent, withdraw your consent at any time

To exercise any of these rights, please contact us at privacy@omma.build. We will respond to your request within 30 days or as required by applicable law. We may ask you to verify your identity before fulfilling your request.

10. California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to request deletion, and the right to opt out of the sale of personal information. As stated above, we do not sell personal information. To exercise your CCPA rights, contact us at privacy@omma.build.

11. European Residents (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases: performance of a contract (providing the Service), legitimate interests (improving and securing the Service), consent (where you have opted into specific features), and compliance with legal obligations.

You have the rights described in Section 9 above and may also lodge a complaint with your local data protection authority if you believe your rights have been violated.

12. Children's Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without verifiable parental consent, we will take steps to promptly delete that information. If you believe we may have information from a child under 13, please contact us at privacy@omma.build.

13. International Data Transfers

Your information may be transferred to and processed in the United States and other countries where our service providers operate. These countries may have data protection laws that differ from those in your jurisdiction. When we transfer data internationally, we ensure appropriate safeguards are in place, including standard contractual clauses or other legally recognized transfer mechanisms, to protect your data in accordance with applicable data protection laws.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. We will notify you of material changes by posting the updated policy on the Service and updating the "Last updated" date at the top of this page. For significant changes, we may also notify you via email. Your continued use of the Service after the updated policy is posted constitutes your acceptance of the changes.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Spline, Inc.

Privacy inquiries: privacy@omma.build

General support: support@omma.build

Security issues: security@omma.build